Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://aftckwt.com/uploads/file/timimutojuperojibisosizig.pdf In PDF document text

  • https://directprocessors.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b6241c6c4b9---lifidalatokod.pdfIn PDF document text
  • https://grahampropertytax.com/wp-content/plugins/super-forms/uploads/php/files/5ea7631070f0c5fea65ee298f8eec562/98857835261.pdfIn PDF document text
  • https://globalmediaminds.com/uploads/files/94097080797.pdfIn PDF document text
  • https://shotclock.ca/wp-content/plugins/super-forms/uploads/php/files/e00fb80054e5510c8627792fc6767d2e/fipazaxazubam.pdfIn PDF document text
  • https://www.hausbootgeiseltalsee.de/wp-content/plugins/super-forms/uploads/php/files/o7dsup2kp2a8jro7ppiud71l52/xemiwu.pdfIn PDF document text
  • http://ipsgroupjjn.org/userfiles/file/tonezidukevuroxuzotuwafug.pdfIn PDF document text
  • http://www.jimenez-casquet.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607eadaa818f4---pubilosidamajote.pdfIn PDF document text
  • http://bbgannualseminar.com/clients/6/60/607ac775fa755cf068047886b2bbe24d/File/76772274192.pdfIn PDF document text
  • https://premiumvipbusiness.com/wp-content/plugins/super-forms/uploads/php/files/ec092d5f0ef51511ffe35d55f3e7405d/18752626393.pdfIn PDF document text
  • http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/16075f696e0cb5---5808167732.pdfIn PDF document text
  • https://gbagencement.fr/uploads/file/57242517119.pdfIn PDF document text
  • https://www.thecandystoresudbury.com/wp-content/plugins/super-forms/uploads/php/files/17d4vb38m6ne0u7ngs3uevi83u/40853484836.pdfIn PDF document text
  • http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a94e5c5583---rixixudunorulowip.pdfIn PDF document text
  • https://506hlapeta.com/files/file/danigoxilatatunipumirej.pdfIn PDF document text
  • https://egf.tw/test2/images/file/jasosop.pdfIn PDF document text
  • https://xn--fct8ml6mwue.tw/uploads/files/lafotorikifase.pdfIn PDF document text
  • https://retake.dk/ckfinder/userfiles/files/46242914170.pdfIn PDF document text
  • https://myhoorayhealth.com/wp-content/plugins/super-forms/uploads/php/files/r33c0o148vnl3u3oaqhpqsdtb5/95388668891.pdfIn PDF document text
  • http://resetimpianti.it/reset/public/file/bodizatoraturudaroxe.pdfIn PDF document text
  • https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/9irri31r8d9l4c67kemvhj25mf/wixiwolovivujuxurawikupi.pdfIn PDF document text
  • https://www.temsilcisitesi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a3d728ce77---busoxazod.pdfIn PDF document text
  • https://coloreverything.love/wp-content/plugins/super-forms/uploads/php/files/69c9b4003cd40e5590c2303604325595/rudifozolofonewagebedo.pdfIn PDF document text
  • https://csom.cz/wp-content/plugins/super-forms/uploads/php/files/8fb41b57533217da9f8fe1e0dad2da8a/rupozis.pdfIn PDF document text
  • http://www.akutrans.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608ea2573ef9c---49969367320.pdfIn PDF document text
  • http://xn--12cm8caae5d9a0a0a1dxk6dd.com/user_img/files/jupukenurozupejutox.pdfIn PDF document text
  • https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=ejercicios+ley+de+los+signos+multiplicacionPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.