Malicious PDF — malware analysis report

Heuristics 6

• ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
• Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK
  PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://etre-belle.su/images/file/58784031394.pdf In PDF document text

  • http://grupomagister.com.br/kcfinder/upload/files/19583883722.pdfIn PDF document text
  • https://dacola.com/upload/files/67124130826.pdfIn PDF document text
  • https://dance-lab-new-delhi.com/userfiles/file/99704181448.pdfIn PDF document text
  • https://capitalsyndic.com/userfiles/file/gekajedexulag.pdfIn PDF document text
  • http://gorsilawfirm.com/userfiles/file/babogegam.pdfIn PDF document text
  • http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/161b8e21d84f77---51507735755.pdfIn PDF document text
  • https://buddingheights.org/wp-content/plugins/formcraft/file-upload/server/content/files/16140b933366d7---3731315265.pdfIn PDF document text
  • https://skillmapmagazine.com/ckfinder/userfiles/files/sikom.pdfIn PDF document text
  • http://etecpresidentevenceslau.com.br/kcfinder/upload/files/8258109969.pdfIn PDF document text
  • https://vanchuyensahara.com/site/files/58273782330.pdfIn PDF document text
  • http://thechelseaff.com/user_uploads/files/44818564042.pdfIn PDF document text
  • http://stadtbild-intervention.de/Quansis/ckfinder/userfiles/files/gagebefatuge.pdfIn PDF document text
  • http://vinhthuan.asia/upload/files/petutosojevegekudadelumu.pdfIn PDF document text
  • http://ciccioinpentola.com/userfiles/files/nunufubuletevi.pdfIn PDF document text
  • http://beganijewellers.com/ckeditor/ckfinder/userfiles/files/12974428753.pdfIn PDF document text
  • https://pet-fashion.ro/mm/file/87555556029.pdfIn PDF document text
  • http://cameronhaddock.com/wp-content/plugins/formcraft/file-upload/server/content/files/1614fa7d3dff98---negogidizirugop.pdfIn PDF document text
  • http://www.hkwebdesign.com.hk/wp-content/plugins/formcraft/file-upload/server/content/files/160f7c424b3d60---sumisanevomezal.pdfIn PDF document text
  • http://petrduchek.com/files/zurowatena.pdfIn PDF document text
  • https://www.prowallpanama.com/wp-content/plugins/super-forms/uploads/php/files/cef7f9f9efd5777424064de4af223281/19277628129.pdfIn PDF document text
  • http://armature.ir/cache/fck_files/file/gatedutetivokidavipasud.pdfIn PDF document text
  • http://www.hkqi.com/wp-content/plugins/formcraft/file-upload/server/content/files/161dc2a57227f6---zopuzureke.pdfIn PDF document text
  • http://zetrade.cz/userfiles/file/xogalojakagutewipule.pdfIn PDF document text
  • https://www.q-jin.ne.jp/ckfinder/userfiles/files/bapasugagubixe.pdfIn PDF document text
  • https://sibois.eu/userfiles/file/86781294730.pdfIn PDF document text
  • http://tractortools.cz/ckfinder/userfiles/files/nalap.pdfIn PDF document text
  • http://tesorosdelayer.es/imgs/images/files/rajos.pdfIn PDF document text
  • http://obkladlazby.cz/userfiles/file/96569320594.pdfIn PDF document text
  • http://unipell.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/162077730201d1---48596551876.pdfIn PDF document text
  • http://www.dismaplant.com/ckfinder/userfiles/files/70308521250.pdfIn PDF document text
  • http://hotelbelleepoque.bg/userfiles/file/92794062887.pdfIn PDF document text
  • https://cylinder96.ru/admin/ckfinder/userfiles/files/xazuwavaredoziteta.pdfIn PDF document text
  • http://www.sunarsurdurulebilir.com/wp-content/plugins/super-forms/uploads/php/files/okdutpbq0sbc7ufsnt959to5j1/xafesovudorepe.pdfIn PDF document text
  • http://hiway54.com/userfiles/file/pulurisudodigu.pdfIn PDF document text
  • http://eprdel.cz/userfiles/file/17832968725.pdfIn PDF document text
  • https://zenmobile.in/jaipriyart/uploads/files/xerapuwobowamafugigenepij.pdfIn PDF document text
  • http://kjphotocon.org/data/userfiles/files/94131134482.pdfIn PDF document text
  • http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/1616d98042bfd7---misexipuzuduzodinixamoz.pdfIn PDF document text
  • http://teresachild.com/upload/files/jaraxawedaxezopofoxa.pdfIn PDF document text
  • http://teplicky-fotograf.robert-zauer.cz/userfiles/file/47557539537.pdfIn PDF document text
  • https://unosms.us/userfiles/file/lurov.pdfIn PDF document text
  • https://safetypadlocks.eu/eurostyl/photos/file/xobotedafo.pdfIn PDF document text
  • http://ferrogep99.hu/static/media/file/53601286597.pdfIn PDF document text
  • http://rockpapersun.com/upload_mce_image/file/nenoxa.pdfIn PDF document text
  • http://csc025.com/userfiles/file/20211126012658_2cz219.pdfIn PDF document text
  • http://hitecds.com/userfiles/file/77198779715.pdfIn PDF document text
  • http://tfh-filter.hu/_user/file/kunopex.pdfIn PDF document text
  • http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/1613d79bd6bba4---74117505529.pdfIn PDF document text
  • https://sunuf.co.za/XSRYdR1H?utm_term=biomass+boiler+installation+guidePDF link annotation

  +9 more URL(s)

Open this report in the interactive analyzer, or submit your own file for analysis.