Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
  PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://atamergranit.com/userfiles/file/mupuwegogifefi.pdf

  • http://expertsystemgroup.com/file_media/file_image/file/vowisapogoxopunojodu.pdf
  • https://robinio.de/wp-content/plugins/super-forms/uploads/php/files/v5t4g3hdk90mlsk0psgtttv27m/banenilupir.pdf
  • http://xn----8sbpvg0afdbe.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/u1kpargjhprusr1nnfs7c2r7j1/67995750229.pdf
  • http://developmentassociationofnagaland.org/nbloom/fckuploads/file/davazetonuvamev.pdf
  • http://ngpsusa.com/wp-content/plugins/super-forms/uploads/php/files/eb7ngmlqtencqg0ivpjb1tg5ub/vopizanopulegepifumovoje.pdf
  • http://smartcookieacademy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609de515ebef7---56754461915.pdf
  • http://aprendanow.com/wp-content/plugins/super-forms/uploads/php/files/a88fd781028bc8df45e03366a327906a/12813934457.pdf
  • http://www.tractortools.cz/ckfinder/userfiles/files/55936830379.pdf
  • http://primethailand.com/ckfinder/userfiles/files/vafewetitefaxo.pdf
  • http://dlt-nkp.com/fileupload//file/16991666110.pdf
  • http://amoy-art.com/Upload/file/9264719606.pdf
  • http://tw-sincere.com/upfiles/editor/files/68236515808.pdf
  • http://adoriantarla.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1606f7fe610aae---dugisejivamuf.pdf
  • https://semineebrasov.ro/printuri-fi/files/39514650857.pdf
  • http://www.reroofingbrisbaneqld.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160b0890cc1445---datosu.pdf
  • https://www.mnspineandsport.com/wp-content/plugins/super-forms/uploads/php/files/4c3f728a50a72494d5dc2f09430c8dc1/93327241950.pdf
  • https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/c23a60863090f233f902fcdfef714467/84529252841.pdf
  • https://www.potterycommercials.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606c7a488255b---77031187777.pdf
  • http://eprdel.cz/userfiles/file/85791684614.pdf
  • https://digiconelectronics.com/media/9599460732.pdf
  • https://www.ayersworthglen.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b0a7fe7b2c6---98318606004.pdf
  • http://wakingbeauty.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607174b4ac103---nidobevu.pdf
  • https://www.vbclighting.com/wp-content/plugins/super-forms/uploads/php/files/2fed55a5bed21a5e958e6985d2766046/jadewuwaboz.pdf
  • https://honghow.com/ckfinder/userfiles/files/tulopafanubozinijesoz.pdf
  • http://www.vivelamusica.es/wp-content/plugins/formcraft/file-upload/server/content/files/16071d2578bd34---67093415429.pdf
  • https://feedproxy.google.com/~r/Uplcv/~3/YTWXjIUwRh0/uplcv?utm_term=canon+sx10is+manual
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#
  • http://purl.org/dc/elements/1.1/
  • http://ns.adobe.com/pdf/1.3/
  • http://ns.adobe.com/xap/1.0/
  • http://ns.adobe.com/xap/1.0/mm/
  • http://ns.adobe.com/xap/1.0/rights/
  • http://dejavu.sourceforge.net
  • http://dejavu.sourceforge.net/wiki/index.php/License

Open this report in the interactive analyzer, or submit your own file for analysis.