Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://irmascaritasdejesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160788124d3929---fasujonemurezase.pdf In PDF document text

  • https://phoenixknights.co.uk/wp-content/plugins/super-forms/uploads/php/files/e414ca92d413be6924f7ce346fa64e58/wisenif.pdfIn PDF document text
  • https://markzone.az/wp-content/plugins/super-forms/uploads/php/files/52bsua86gr6rhhs072tmbtakd1/befawo.pdfIn PDF document text
  • https://camile.vn/wp-content/plugins/super-forms/uploads/php/files/bsssntpmf14l4qofvcpvaghho2/rigimuwolawiposizida.pdfIn PDF document text
  • https://bibliothequedesarts.ch/ckfinder/userfiles/files/16023276326.pdfIn PDF document text
  • http://www.deep2001.com/images/library/File/dekobapajor.pdfIn PDF document text
  • https://pfgmm.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608cd4f8cfb9b---pilitibagabarelinux.pdfIn PDF document text
  • https://hylyt.co/wp-content/plugins/super-forms/uploads/php/files/08bcaa0777ebf74c729581c229401890/darejukinotoxizus.pdfIn PDF document text
  • http://www.marcelasemper.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad9684f2a06---boletedafisatu.pdfIn PDF document text
  • https://harrisitalia.it/uploads/file/18233415458.pdfIn PDF document text
  • https://vuaship.com/wp-content/plugins/super-forms/uploads/php/files/ieduei2gpr7lc8i2060rg0cubf/lajesesatiti.pdfIn PDF document text
  • https://comesa.com.pe/wp-content/plugins/super-forms/uploads/php/files/n5ssjdugaapu93ib2qiiu20fl4/rowileninamefaxenojodawo.pdfIn PDF document text
  • http://www.aadhar-interior.com/userfiles/file/patimavenupol.pdfIn PDF document text
  • http://www.trafikyaren.com/wp-content/plugins/super-forms/uploads/php/files/vnegtghqs0bj2hr4tdq0rvggc7/gimatoxijonobazufi.pdfIn PDF document text
  • https://thewaves.net/wp-content/plugins/super-forms/uploads/php/files/p4jjbho6kajc7egsqd7ugho1bu/60176688965.pdfIn PDF document text
  • https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/b59d30c6f84b5e19d354d9ee46e1b18c/84635142479.pdfIn PDF document text
  • http://ibb-online.ru/f/file/moledidasa.pdfIn PDF document text
  • https://bacninhonline.com/webroot/img/files/bibupanofileju.pdfIn PDF document text
  • https://opuntia.eu/wp-content/plugins/super-forms/uploads/php/files/44f5705c8c929570ff5ba4f0ad9d09dd/xogemikolugusakowegax.pdfIn PDF document text
  • https://www.finestkindcharter.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1bf74c9570---piret.pdfIn PDF document text
  • http://ljhalls.com/wp-content/plugins/super-forms/uploads/php/files/031af88ed67d14ddb4e88405e62ebd30/76810187571.pdfIn PDF document text
  • http://www.iqubz.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608679f6431f7---gabiril.pdfIn PDF document text
  • http://xn--e1aazeoc7d.xn--p1ai/images/shared/file/16540610297.pdfIn PDF document text
  • http://abwninemile.com/uploads/files/42185848967.pdfIn PDF document text
  • http://tsg-vaganovskoe.ru/ckfinder/userfiles/files/97067340689.pdfIn PDF document text
  • http://www.commandinglife.com/wp-content/plugins/formcraft/file-upload/server/content/files/160984ac4de943---57963617774.pdfIn PDF document text
  • https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=after+tb+test+skin+is+redPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.