Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
  The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://masterok-kovka.ru/wp-content/plugins/super-forms/uploads/php/files/d7b816b9069aab311481ca6f6ea4ff0d/14033120502.pdf In PDF document text

  • https://1sis.com/wp-content/plugins/formcraft/file-upload/server/content/files/160df41e12e68d---31190778972.pdfIn PDF document text
  • https://ratco-hardware.com/Ups/files/nudovidirawovijirajev.pdfIn PDF document text
  • http://freemansphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607579741b936---72802840282.pdfIn PDF document text
  • http://www.medical-psychology.gr/wp-content/plugins/formcraft/file-upload/server/content/files/16079dc13e6f0f---79995933692.pdfIn PDF document text
  • https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/97obec2io1um7v8sn666g6qcj5/90552329787.pdfIn PDF document text
  • https://u-spot.biz/js/ckfinder/userfiles/files/31127166894.pdfIn PDF document text
  • https://xn--80aaa1anac6cg.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/891772837337c57812f3bb45d48dffac/wobawuxawibogebek.pdfIn PDF document text
  • https://saleskerala.com/ckfinder/userfiles/files/sulix.pdfIn PDF document text
  • https://creativesilhouettes.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608e4ff059962---3299095942.pdfIn PDF document text
  • https://www.nordatec.com/wp-content/plugins/super-forms/uploads/php/files/oi8esmff49l1762urgd7jdfh2n/kixuridebapojumuxil.pdfIn PDF document text
  • https://laser-arena.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1607fbd6dbd93d---kovebi.pdfIn PDF document text
  • https://dienlanhhonganh.com/images/pic/file/84696745454.pdfIn PDF document text
  • https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607f9bd588a5d---dowufabekujenimo.pdfIn PDF document text
  • https://agmatbaa.com/upload/files/guwifu.pdfIn PDF document text
  • http://admio.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160c98ca491358---65879213776.pdfIn PDF document text
  • http://ceskylakros.cz/userfiles/file/14070615583.pdfIn PDF document text
  • https://www.demetagras.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607971c198c1e---3053269752.pdfIn PDF document text
  • http://www.dj-csnl.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a0eededa4b0---26777519021.pdfIn PDF document text
  • https://www.aserspa.net/wp-content/plugins/super-forms/uploads/php/files/ucghgr2nq329aob9cctlrrfc4r/pogoxama.pdfIn PDF document text
  • http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099baecce1d4---66660246300.pdfIn PDF document text
  • https://propertiproperty.com/Uploads/userfiles/files/kufijupojogofi.pdfIn PDF document text
  • https://mamotato.ro/userfiles/file/47041656442.pdfIn PDF document text
  • https://beautifullifeuk.com/wp-content/plugins/super-forms/uploads/php/files/a13ddd9dee026d889181a6941227556e/gakesemod.pdfIn PDF document text
  • https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607b37adef4ab---46854114138.pdfIn PDF document text
  • https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=libros+de+coaching+pdf+gratisPDF link annotation
  • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
  • http://purl.org/dc/elements/1.1/In PDF document text
  • http://ns.adobe.com/pdf/1.3/In PDF document text
  • http://ns.adobe.com/xap/1.0/In PDF document text
  • http://ns.adobe.com/xap/1.0/mm/In PDF document text
  • http://ns.adobe.com/xap/1.0/rights/In PDF document text
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.