MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating it functions as a link farm hosted on compromised CMS uploads. Multiple URLs point to WordPress plugin upload directories, suggesting an attempt to disguise malicious links within legitimate-looking file paths. The presence of numerous distinct hosts and UTM parameters in some URLs further supports the link farm and potential phishing or malware distribution intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.9952
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.skyline-recruiting.com/wp-content/plugins/super-forms/uploads/php/files/a07d6a167cf5a2421cf29dd579ebfcc1/56006235164.pdf In PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098f29db357e---1552331826.pdfIn PDF document text
- https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/741fcf973aa9ea95dac8feb94d52623b/wobega.pdfIn PDF document text
- http://bilagroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f31d33ede1---76322671956.pdfIn PDF document text
- http://tomaszfilipczak.pl/userfiles/file/11136625793.pdfIn PDF document text
- http://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606f7008202a1---28119940424.pdfIn PDF document text
- http://jedwines.com/cmsCart//upload/file/dawuzulawikipidule.pdfIn PDF document text
- https://medicinasolidale.org/wp-content/plugins/super-forms/uploads/php/files/aef2a1371acf40f7b188016befea663e/roxuferazakowigugu.pdfIn PDF document text
- https://cashcruis.ru/wp-content/plugins/super-forms/uploads/php/files/9a1b76868c7d7cd932866780a39ac6ba/87214323422.pdfIn PDF document text
- https://www.mixedclass.com.au/wp-content/plugins/super-forms/uploads/php/files/mm7sipq05nu44kvuc4g4k9pqbk/40939585222.pdfIn PDF document text
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ba169d5e110---tubas.pdfIn PDF document text
- https://cms.blauraum.com/wp-content/plugins/super-forms/uploads/php/files/a82a4fe12685cab0ee58d1cf353e50f8/78808792467.pdfIn PDF document text
- http://www.grundys.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160747c9d4bb69---84919731643.pdfIn PDF document text
- http://calisnt.com/uploads/files/zivizepobulopololaregon.pdfIn PDF document text
- https://mkting.com.co/wp-content/plugins/super-forms/uploads/php/files/2bc8e0fedc3662590f16448d4364229a/98727903822.pdfIn PDF document text
- https://finances-canada.com/wp-content/plugins/super-forms/uploads/php/files/18ba2ce5992f6a91e18bc16ef796afa4/xexopofanewoguvawuguv.pdfIn PDF document text
- http://www.grupohk.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16093c956130c2---gekoravatujaroporovobozev.pdfIn PDF document text
- https://beaufortbond.com/wp-content/plugins/super-forms/uploads/php/files/ceb8d658ffb4f8802495cbdc1212eb34/97341677051.pdfIn PDF document text
- https://www.kngroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b0b1dad9a49---79950811159.pdfIn PDF document text
- https://gdr.co.il/wp-content/plugins/super-forms/uploads/php/files/219c3c249fb0bf0de893b2250f38a619/4678193589.pdfIn PDF document text
- http://kwartetproforma.com/userfiles/file/59611415477.pdfIn PDF document text
- http://webscape.co.bw/wp-content/plugins/formcraft/file-upload/server/content/files/160706adf5d503---jozapinu.pdfIn PDF document text
- http://mujuerp.com/uploads/ckeditor/files/20210603125941.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=hp+1410+switch+manualPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ee36.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEE36 | 10716 bytes |
SHA-256: 4f03934b5a9894e82d60717b8eb95fbe2cd26d152add8a7320cd44ee237141d2 |
|||
font_01_sfnt_off000106b8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x106B8 | 21132 bytes |
SHA-256: 8a8924da2d4f8e58a97bdabfcc0fedbd914b75c839376e4171953563a19ee19a |
|||
font_02_sfnt_off00013d90.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13D90 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.