Malicious PDF — malware analysis report

Heuristics 7

• ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
  ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
• PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM
  PDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
• Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
  Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
• Embedded JS stream low PDF_JS
  PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
• External URI info PDF_URI
  PDF contains an external URL action
• PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
  The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL http://erkerlaender.de/wp-content/plugins/formcraft/file-upload/server/content/files/1609c0a0b5c5b3---rezowubi.pdf In PDF document text

  • http://zonwering-belgie.be/ckfinder/userfiles/files/27461390679.pdfIn PDF document text
  • https://www.conkite.com/wp-content/plugins/super-forms/uploads/php/files/4354a7f092f47b251d2f4432ebb2580f/68339790407.pdfIn PDF document text
  • http://worldnaturalfood.com/image/upload/File/32525280495.pdfIn PDF document text
  • http://melissajacksonmd.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070e17ae43a6---97956459950.pdfIn PDF document text
  • http://tourister.kr/userfiles/file/jaxarim.pdfIn PDF document text
  • https://amezdigital.com/wp-content/plugins/super-forms/uploads/php/files/e25a704f16ddbf86a1edb391a3922c00/gorutugimo.pdfIn PDF document text
  • https://hotelristorantenovecento.it/wp-content/plugins/super-forms/uploads/php/files/211bf1a729a262c265e8ea43c1673eac/renub.pdfIn PDF document text
  • http://dui-antidote.net/images/userfiles/file/6708189229.pdfIn PDF document text
  • http://michelschuurmans.nl/images/uploads/file/7052065720.pdfIn PDF document text
  • https://www.advids.io/wp-content/plugins/formcraft/file-upload/server/content/files/16084eeb38b092---93810644897.pdfIn PDF document text
  • http://nhadep30giay.com/uploads/image/files/ruvumumetujozuv.pdfIn PDF document text
  • http://www.neslihanonur.com/wp-content/plugins/super-forms/uploads/php/files/a4a58d042bff940e82cfc1ad02efceaf/30306057540.pdfIn PDF document text
  • http://alphamarino.kz/images/news/file/pigapupaluzarepopevenumer.pdfIn PDF document text
  • https://arch.ua/ckfinder/userfiles/files/mijumuvipuverajadalebones.pdfIn PDF document text
  • http://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/a8293f5e334be5f331f290ac0f216eed/zelirigefitadomo.pdfIn PDF document text
  • http://thegioituigiay.net/uploads/files/nijimukiledebedesa.pdfIn PDF document text
  • https://edoxmarketing.com/wp-content/plugins/super-forms/uploads/php/files/di0a70qhlrv8aa8rqvqthj3fcr/27332775481.pdfIn PDF document text
  • http://ttlh.vn/storage/ckfinder/files/wavisiso.pdfIn PDF document text
  • https://www.baptistenhardenberg.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16094643fa4a2c---16073548207.pdfIn PDF document text
  • http://exim5.hu/_user/file/13359406060.pdfIn PDF document text
  • https://myparrotfood.com/user_files/files/98735710784.pdfIn PDF document text
  • http://www.la-rocca.pl/app/webroot/files/files/37983359241.pdfIn PDF document text
  • http://www.premiumimport.nl/ckfinder/userfiles/files/47840700860.pdfIn PDF document text
  • http://www.thegrcinstitute.org/app/webroot/js/ckfinder/userfiles/files/19691853745.pdfIn PDF document text
  • http://thedewakohchang.com/image/upload/File/6434794704.pdfIn PDF document text
  • https://careerroots.net/ckfinder/userfiles/files/serolimulejujomebotu.pdfIn PDF document text
  • https://kassa-evotor.ru/wp-content/plugins/super-forms/uploads/php/files/e2ica2793v758o55h2gdo1uujc/59698019225.pdfIn PDF document text
  • https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3vuEKuznOb8/uplcv?utm_term=how+to+calculate+voltage+drop+in+cables+pdfPDF link annotation
  • http://dejavu.sourceforge.netIn PDF document text
  • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.