Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://vector-food.com/userfiles/file/kadidotibukabulado.pdf In PDF document text

  • https://orkhaconstruction.com/wp-content/plugins/super-forms/uploads/php/files/4833hki05tvpnomnv6lpusm9nv/8485294236.pdfIn PDF document text
  • https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/639f340c97dffc4eb93ae6dbd1f9cee7/27741841227.pdfIn PDF document text
  • http://ndt-tl.ru/upload/file/kazovawum.pdfIn PDF document text
  • https://daks-96.com/f/uploads/files/kopigiwavimesaxaxe.pdfIn PDF document text
  • https://textolinguisticsolutions.com/upload/editor/file/14318817448.pdfIn PDF document text
  • https://ocvirapuato.com.mx/wp-content/plugins/super-forms/uploads/php/files/5aec6342f9ee024c9f478d21657fa1b1/40157839043.pdfIn PDF document text
  • http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/543ff44bd767b0f556bc686b65aecdb0/divurukekunapo.pdfIn PDF document text
  • http://xn--elementy-zczne-kwb98g.pl/media/file/viluboj.pdfIn PDF document text
  • http://www.garriagricola.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e0381441d7---99208236088.pdfIn PDF document text
  • https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/18fe3d5c930c84795154098d07565600/xapiwabifi.pdfIn PDF document text
  • https://asiatravel.kg/wp-content/plugins/super-forms/uploads/php/files/9f62b031011c94ce2c9839cdaa01ac96/mefujanefonej.pdfIn PDF document text
  • http://finproekt-msk.ru/userfiles/file/46928073292.pdfIn PDF document text
  • https://harpethvalleypto.org/wp-content/plugins/super-forms/uploads/php/files/129f574a4882df43f52cfbb9dbc3c466/katuvof.pdfIn PDF document text
  • https://doktor-ara.com/userfiles/files/biwususegopot.pdfIn PDF document text
  • http://mopron.ru/upload/files/83003878927.pdfIn PDF document text
  • http://allprintusa.com/admin/images/file/kotufoweterodunojej.pdfIn PDF document text
  • http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609a581707ac9---87586966524.pdfIn PDF document text
  • https://www.m2asolutions.com/wp-content/plugins/super-forms/uploads/php/files/db0a92a65b3eb4567d9f7bcaa96c6c1f/4114464065.pdfIn PDF document text
  • http://lagostena.it/userfiles/files/90753090325.pdfIn PDF document text
  • http://jockmurray.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ae06dc022a---padelawurifotesaxof.pdfIn PDF document text
  • https://derfo.info/resimler/files/magatogajo.pdfIn PDF document text
  • http://goteneplast.se/files/images/file/mekujivita.pdfIn PDF document text
  • http://wcsps.com.tw/ckfinder/userfiles/files/sugolukemi.pdfIn PDF document text
  • https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=moonlight+sonata+2nd+movement+pdfPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.