MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous links, many of which point to compromised WordPress sites acting as a link farm. The ML classifier and ClamAV detection strongly indicate malicious intent, likely phishing or malware distribution. The file's structure and URL patterns are consistent with a malicious link farm designed to lure users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9835
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://stakeoutllc.com/wp-content/plugins/super-forms/uploads/php/files/c978da91a850951229e5eac7dd3d11d9/42273259094.pdf
- http://www.uppld.org/wp-content/plugins/formcraft/file-upload/server/content/files/160b5e3b6f17d6---88046351916.pdf
- http://furkansigorta.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160c8d4b71d855---80697356084.pdf
- http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609827c8e8c4b---sexumovago.pdf
- http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160a6d5154ac14---kutodebujuzelapedudo.pdf
- https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d7c1423e4b---28240775450.pdf
- https://big-cash.de/wp-content/plugins/super-forms/uploads/php/files/fvkiicr1ioi7i482uk4ti9h11n/nufavewawibeganodi.pdf
- https://area5srl.it/file/30092256703.pdf
- http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/16080771820918---mejolaveku.pdf
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c41c5aaf71f---wonubatemef.pdf
- https://www.kbstephens.com/wp-content/plugins/super-forms/uploads/php/files/1b466f92c0c1bb45f3176dcd85ea656b/bobogisuxulaxuju.pdf
- https://fiambreszav.com/wp-content/plugins/super-forms/uploads/php/files/6789ca8358a78856c837475284cbe385/14768077839.pdf
- http://www.kmclogistics.com/wp-content/plugins/super-forms/uploads/php/files/ae16c2389726782bca9ad74a02a3da46/18389310004.pdf
- http://clearlakesd.org/wp-content/plugins/formcraft/file-upload/server/content/files/160bc0bd032c87---73456034677.pdf
- http://sbs-group.co/userfiles/files/lorurogulomafe.pdf
- https://seroinstitute.com/wp-content/plugins/super-forms/uploads/php/files/1b22347bef6a53cbb79eb72b5fb2a20b/41167375278.pdf
- http://cupta.org/userfiles/files/20210527123647.pdf
- http://www.insurancedirectcanada.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160a09835ccb5b---pijanogekoloxavovule.pdf
- https://georgiamusicpartners.org/wp-content/plugins/super-forms/uploads/php/files/9e41eaff17a5e7e7e4d03f01dc8aec27/mivatonuduwexubodutonux.pdf
- http://naturallabs.de/userfiles/file/39981249123.pdf
- https://hightechrustremovers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a8963ca3f7e---wosobepanova.pdf
- https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/5drrbbcvbshb9cf8d1j8cf43kn/27000786937.pdf
- https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d6bf5c92cf---67817174200.pdf
- https://cananalimdar.com/wp-content/plugins/super-forms/uploads/php/files/9k8cj1rafcii82uq0sblbi9nuv/rubulumugul.pdf
- http://www.dramayaramendes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16070a8f070c8c---39449429334.pdf
- https://webfox.net.au/wp-content/plugins/super-forms/uploads/php/files/4f94fb9e072aa0c3881c762d59364615/dinov.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=exposition+in+fiction
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001098e.binedb12ebd3bf58d72879ebf14cef1377d9c40883796db38fcb48d8113684a6d4f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1098E | 17516 bytes |
font_01_sfnt_off000136cc.bin9b0dbcf2fb38185b7979c56d9666b59597fc420636b76b538e825c08e5fdf6d5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x136CC | 10120 bytes |
font_02_sfnt_off00014d8d.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14D8D | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.