Malicious PDF — malware analysis report

Heuristics 5

• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://inwebjor.ru/uplcv?utm_term=turbonetics+single+turbo+kit+350z+review PDF link annotation

  • https://www.expoagrogto.com/wp-content/plugins/super-forms/uploads/php/files/s3e4s28v2dphjih89934vh42p3/ruvebu.pdfIn PDF document text
  • https://masterok-kovka.ru/wp-content/plugins/super-forms/uploads/php/files/3f46c07632693df528c01a1225e17125/sefojojosir.pdfIn PDF document text
  • https://cashmeredreams.com/wp-content/plugins/super-forms/uploads/php/files/acb25bdad42e32d8e0c00dd7e4b35459/medogasipusozexowi.pdfIn PDF document text
  • http://www.theagentpipeline.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072e8f0ea95f---67301134930.pdfIn PDF document text
  • http://live-lessons.net/lcj/web/uploads/assets/file/44308933295.pdfIn PDF document text
  • https://aldea.work/wp-content/plugins/super-forms/uploads/php/files/49e20dfc94323e0e0991ae00ad23fd19/84065857693.pdfIn PDF document text
  • http://bilagroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a87567d80de---16724318071.pdfIn PDF document text
  • http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c89ef805e2f---84288160948.pdfIn PDF document text
  • http://alexlunacoach.com/img/editor/file/seribexafujuzivegudizulu.pdfIn PDF document text
  • https://lsp.od.ua/wp-content/plugins/super-forms/uploads/php/files/etpos1p0rb4j3tnae0233799a6/pelagat.pdfIn PDF document text
  • http://bachtungcompany.com/upload/files/rewalexuxej.pdfIn PDF document text
  • http://www.iqubz.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d34ad842313---47613263900.pdfIn PDF document text
  • http://kindervakantieweekdeurne.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a05203aa132---toradama.pdfIn PDF document text
  • https://joyfool.art/wp-content/plugins/super-forms/uploads/php/files/9f5ed321c4835a7af9d860fcc35d08a0/kabotomewetijusugobo.pdfIn PDF document text
  • http://divorce-difficile.fr/userfiles/file/46709375952.pdfIn PDF document text
  • https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/2b59d6f9cbcb8b1a1f130184f6d2c6fd/dojafo.pdfIn PDF document text
  • http://zhengfutz.com/v15/Upload/file/20217101813234289.pdfIn PDF document text
  • https://daleel.global/wp-content/plugins/super-forms/uploads/php/files/lr1hraq4tr651soo2oen8o2emv/zerigapod.pdfIn PDF document text
  • https://lightspec.ca/wp-content/plugins/super-forms/uploads/php/files/ba00bc452634c07e6cbddff76671d28a/zogadidokamanu.pdfIn PDF document text
  • https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/474niojkcaibn9gapsvv0lvfba/fubase.pdfIn PDF document text
  • https://promocionesnma.com/wp-content/plugins/super-forms/uploads/php/files/d62b92a85f873ee761ac5aea64caa269/29802517547.pdfIn PDF document text
  • http://mtecommerce.it/public/news/file/wukifuwasuweguf.pdfIn PDF document text
  • https://ecobox.eng.br/wp-content/plugins/super-forms/uploads/php/files/e8m8qa59ohd2mag54pq5cnefrh/zekenago.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.