MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file is identified as malicious by ClamAV and an ML classifier, with heuristics indicating it functions as a link farm hosted on compromised CMS uploads. The document body, though partially corrupted, contains text suggesting a lure for free movie streaming, which is a common phishing tactic. The embedded URLs point to various domains, many of which are likely part of a coordinated campaign to host malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9998
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://trsbarriersdirect.com/wp-content/plugins/super-forms/uploads/php/files/4om9v964fm82l0ksokds2d9kn2/95545249593.pdf In PDF document text
- https://arizonapoolcontractor.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b05cfde92f7---waluvunebirer.pdfIn PDF document text
- https://dineflon.com//files/xikonivikegeg.pdfIn PDF document text
- http://vtracauto.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a02e2571c73---votetepedanafedamamoxi.pdfIn PDF document text
- https://www.swissfillon.com/wp-content/plugins/super-forms/uploads/php/files/a5ad5294331c715de72441bd0856969a/59799256017.pdfIn PDF document text
- https://razvozka24.ru/wp-content/plugins/super-forms/uploads/php/files/57a7f288275c18cb11dbdfeb4c3926ff/57076699876.pdfIn PDF document text
- https://maydongy.com/wp-content/plugins/super-forms/uploads/php/files/37k6oobb30ja4bbu659i7n57lq/vibagawa.pdfIn PDF document text
- http://moyamoya.center/images/hand_uploaded/files/porobazadifa.pdfIn PDF document text
- http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a238efd477f---jagezuretepivubolamuta.pdfIn PDF document text
- http://nordicaluminium.ru/userfiles/file/vafewagorevumaditi.pdfIn PDF document text
- https://www.energetisch-therapeut-estie.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1609c621175001---wotogudawawavumuke.pdfIn PDF document text
- https://www.hotwaterfactory.com.au/wp-content/plugins/super-forms/uploads/php/files/f758ce9302153c0779855a0682200e98/pezovusosixifet.pdfIn PDF document text
- https://brandonsmilesdentistry.com/wp-content/plugins/super-forms/uploads/php/files/h89pgv3mvq3ousg9j0r9lq6bd4/2847912424.pdfIn PDF document text
- https://doitsolutions.co/wp-content/plugins/super-forms/uploads/php/files/778d0d82d6b3c43dab1132653ce15f79/98228268119.pdfIn PDF document text
- https://londonvipchauffeur.co.uk/wp-content/plugins/super-forms/uploads/php/files/d1ea39b20a03a07288aa4e205d3919e5/katimofokalazuk.pdfIn PDF document text
- https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/b2ce1b7516a5701afa94165cca952343/kopelewo.pdfIn PDF document text
- https://www.projectorrentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077ce714b6e3---ratezewopomisoxoligozo.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=ver+dioses+de+egipto+pelicula+completa+en+espa%25C3%25B1ol+latino+online+gratisPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d1a7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD1A7 | 3312 bytes |
SHA-256: ac66ddecb1889e99694234647e4a1e19b6174440e696c9ee44c6cb9711419273 |
|||
font_01_sfnt_off0000dd88.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDD88 | 5572 bytes |
SHA-256: 4614fa186d16bfd9243b06b26a8d06bdcc090dc5507a4e60e4ff85205a2b7e0b |
|||
font_02_sfnt_off0000f028.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF028 | 10784 bytes |
SHA-256: 20a09cbdd1758e4299d25792597632ef5cec7a03eccfced215134f6d821a3298 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.