Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://infrive.ru/uplcv?utm_term=minecraft+night+vision+potion+8+minutes PDF link annotation

  • https://www.straightmyteeth.com/wp-content/plugins/super-forms/uploads/php/files/0538120ddb8d2a5834ec4d10f0652bbd/8165976220.pdfIn PDF document text
  • https://tezerwatch.com/file/upload/files/07-10-02-36-33-69.pdfIn PDF document text
  • https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/160964ac611e82---58776192971.pdfIn PDF document text
  • http://danfilenemd.com/clients/67744/File/zijuru.pdfIn PDF document text
  • http://staging.impactredevelopment.com/wp-content/plugins/formcraft/file-upload/server/content/files/160759afac7757---30525196927.pdfIn PDF document text
  • https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/61613a24d6256f6f89c8ce80bb89e13f/57757122635.pdfIn PDF document text
  • https://www.numberoneporthill.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160aecb8046ea0---lukajizabozenibekine.pdfIn PDF document text
  • https://mytutr.com/wp-content/plugins/super-forms/uploads/php/files/2c3cac5f5576e5cee197b56074fe509f/48146470897.pdfIn PDF document text
  • https://egokituz.eus/files/galeria/files/67161520885.pdfIn PDF document text
  • http://www.gunyagder.org.tr/wp-content/plugins/super-forms/uploads/php/files/jfe1io4dmoa5d745l3ek7avb01/gufapogevorolonuxorupi.pdfIn PDF document text
  • http://citranco.com/users/files/tekalu.pdfIn PDF document text
  • https://www.dishdivvy.com/wp-content/plugins/super-forms/uploads/php/files/e21f8495857f0961ae35b6fe08b69b3c/38290955733.pdfIn PDF document text
  • https://canadiancontractorservices.com/wp-content/plugins/super-forms/uploads/php/files/tbebrpaem3snhurdluerb9i1m6/tagizofep.pdfIn PDF document text
  • http://constructionone.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b2d1af89613---jepevogokomatifaseseg.pdfIn PDF document text
  • http://elyriahigh1974.org/clients/0/05/052ab20d644b737728595af1a47b4450/File/22949773256.pdfIn PDF document text
  • http://bsbcarpet.com/userfiles/file/86186829095.pdfIn PDF document text
  • http://oneself.pro/wp-content/plugins/formcraft/file-upload/server/content/files/1608ddc2e1e6ee---natisipovafusidet.pdfIn PDF document text
  • http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1f173d11a---17353420565.pdfIn PDF document text
  • http://payassistinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099d72f2f681---pewepozaku.pdfIn PDF document text
  • http://iqmuseum.mn/uploads/files/2188798007.pdfIn PDF document text
  • https://www.alapan.org/fckimages/file/nogozatawekila.pdfIn PDF document text
  • https://idfusionllc.com/wp-content/plugins/super-forms/uploads/php/files/470f0801d4124ae151b87ed2c5bded12/visebidusuwivuxur.pdfIn PDF document text
  • http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160aa8839968f9---77374753793.pdfIn PDF document text
  • https://engravestone.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cfd41ad00e5---41410165583.pdfIn PDF document text
  • https://www.endthestigmacounselling.com/wp-content/plugins/super-forms/uploads/php/files/e4445ms7i88qhvp9vnivoivfvg/lesagowaduvijepetavune.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.