Malicious PDF — malware analysis report

Heuristics 5

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://balance-global.com/wp-content/plugins/super-forms/uploads/php/files/f32ke6j3p1hu16f3rdukpj9cct/vuvuwesufi.pdf In PDF document text

  • https://parisautotravel.com/wp-content/plugins/super-forms/uploads/php/files/eupdgemgn4hgqg493kj19hj2q6/87835674520.pdfIn PDF document text
  • http://bobmeetin.com/media/galleries/files/76983597480.pdfIn PDF document text
  • http://4bx.pl/public/file/88057330292.pdfIn PDF document text
  • http://asalsold.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfad6fcdab8---92280555716.pdfIn PDF document text
  • https://infravoip.com/wp-content/plugins/super-forms/uploads/php/files/10d1d68c61c596d389b82c7401c041a4/varulevasoloputobufive.pdfIn PDF document text
  • https://www.penyembuhanholistikreiki.com/wp-content/plugins/formcraft/file-upload/server/content/files/160850f79d4f01---72540280045.pdfIn PDF document text
  • https://www.havanasalsa-dance-tours.com/wp-content/plugins/super-forms/uploads/php/files/0c511e038307934ad00aac3e319fbdec/91318151012.pdfIn PDF document text
  • http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/msfp9rbhstqru6ol2i4pmhcqa2/41533736625.pdfIn PDF document text
  • https://www.nobleorthodontic.com/wp-content/plugins/super-forms/uploads/php/files/0a599d10afc3338f0a262af1348c53ae/fisuvoxibabopujopu.pdfIn PDF document text
  • https://bombapin.com/calisma2/files/uploads/faxazatow.pdfIn PDF document text
  • http://ulrike-mayer.de/userfiles/files/miworamedopupewopodenexe.pdfIn PDF document text
  • http://luluscafeonline.com/uploads/files/mikixut.pdfIn PDF document text
  • https://firesystem.ro/imagini_ws/75435073668.pdfIn PDF document text
  • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609484bc695a1---23922522150.pdfIn PDF document text
  • https://utilitydiscount.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a4207c15dbf---nobepuduropurowi.pdfIn PDF document text
  • http://balassalaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/88354644923.pdfIn PDF document text
  • https://interesttour.com/wp-content/plugins/super-forms/uploads/php/files/4016a292d264362efe7a5b42191cdbe7/79680591066.pdfIn PDF document text
  • http://bridgesonthepark.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f3dfb59128---kagetonagol.pdfIn PDF document text
  • https://absolut-fit-and-dance.de/wp-content/plugins/super-forms/uploads/php/files/0v42f7l1rk0luin7u58qvi26ae/40129620142.pdfIn PDF document text
  • https://www.goldenplanet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1607025b941fb7---26809568713.pdfIn PDF document text
  • http://ztkammer.at/uploads/file/ginekoruzewogezajojim.pdfIn PDF document text
  • https://www.ijmsir.com/ckfinder/userfiles/files/56687532439.pdfIn PDF document text
  • http://saokienviet.com/uploads/image/files/mikobowek.pdfIn PDF document text
  • http://backupcenters.com/userfiles/file/82551334578.pdfIn PDF document text
  • http://www.zopfitravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071202126987---74060635485.pdfIn PDF document text
  • https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e0b5383b60---pavufibikegunuvifuw.pdfIn PDF document text
  • https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=one+piece+dub+all+episodesPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.