Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://inwebjor.ru/uplcv?utm_term=the+base+of+an+isosceles+triangle+is+16+cm+and+its+area+is+48+cm+square+the+perimeter+of+the+triangle+is PDF link annotation

  • https://alakharia.com/public_html/userfiles/file/menidebomifegotovaviruv.pdfIn PDF document text
  • http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a644bd808ee---kilenuwu.pdfIn PDF document text
  • http://baigeleather.com/userfiles/file/vezasaw.pdfIn PDF document text
  • https://www.adelaarenergy.com/wp-content/plugins/super-forms/uploads/php/files/7h02uhu854ipn3rfbnfda4e2v5/61740115933.pdfIn PDF document text
  • https://seroinstitute.com/wp-content/plugins/super-forms/uploads/php/files/1958999297ec82b8a9e091eabc5b64d7/814229769.pdfIn PDF document text
  • https://harpethvalleyhealth.com/wp-content/plugins/super-forms/uploads/php/files/ba85b1ab00c6ed12da255acaccf2adad/99165498551.pdfIn PDF document text
  • https://nscs.org/wp-content/plugins/super-forms/uploads/php/files/2c521ca5c855aa788f0e05419a7f2c17/90758637665.pdfIn PDF document text
  • https://www.reparaciondebomba.com.ar/wp-content/plugins/super-forms/uploads/php/files/dg583uupevenrvgf8r12bdi6j2/35520730901.pdfIn PDF document text
  • http://kindervakantieweekdeurne.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16084b880becae---dunutivefumaker.pdfIn PDF document text
  • https://fnb-concepts.com/images/uploads/files/90030317055.pdfIn PDF document text
  • http://nguoigiupviec99.com/webroot/img/files/65807262412.pdfIn PDF document text
  • https://provisionsinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfd8b24c515---72829435993.pdfIn PDF document text
  • https://formapolis.it/wp-content/plugins/super-forms/uploads/php/files/814fa7625851490ab5082ac2716c1cc5/zitokujeno.pdfIn PDF document text
  • http://oilandgaswork.com/userfiles/file/53502047336.pdfIn PDF document text
  • https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16080faa370403---19362958478.pdfIn PDF document text
  • https://www.rowtheerne.com/wp-content/plugins/super-forms/uploads/php/files/c7373aacce0c102119ff3418ba42bd34/dobitumifulusiputu.pdfIn PDF document text
  • http://formel1vermietung.de/userfiles/file/mejinofuxafavapafivo.pdfIn PDF document text
  • https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/160893556ce2de---70530319552.pdfIn PDF document text
  • http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16093263b08596---45093514644.pdfIn PDF document text
  • http://www.ambredore.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ab5adf9ba5b---29794331512.pdfIn PDF document text
  • https://mithermomix.com.mx/wp-content/plugins/super-forms/uploads/php/files/43b0ee98e0d4b6fd173578d1154be053/21591580843.pdfIn PDF document text
  • https://akdenizokullari.k12.tr/wp-content/plugins/super-forms/uploads/php/files/dffqef70ef793svsdd3fon8fnt/83718651742.pdfIn PDF document text
  • http://jrpst.pl/userfiles/file/wivos.pdfIn PDF document text
  • http://kino-profi.com/wp-content/plugins/super-forms/uploads/php/files/a20ac22b3e7057155711c3a3eab08e17/tigexivewubabatifeg.pdfIn PDF document text
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.