MALICIOUS
194
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was detected as malicious by ClamAV and a machine learning classifier. It contains numerous links to compromised websites, indicating a phishing or malware distribution scheme. The PDF's structure suggests it acts as a lure, directing users to external resources that likely host malicious content or phishing pages.
Machine Learning
- Nyx PDF Classifier malicious score 0.8744
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://iveducentar.com/uploads/assets/file/nisodujevarobajofesa.pdf In PDF document text
- http://debsecond.net/UserFiles/File/fobetubimipobekid.pdfIn PDF document text
- https://cevhertemizlik.com/userfiles/files/85272632398.pdfIn PDF document text
- http://www.letnifestiwal.pl/ckfinder/userfiles/files/77677165413.pdfIn PDF document text
- http://belloverde.net/emailer/file/87179637623.pdfIn PDF document text
- http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161409e8fbe59f---58430056287.pdfIn PDF document text
- https://hopefor.today/wp-content/plugins/super-forms/uploads/php/files/49f77e2ad5ea4834715e4c566341f019/seguwadavixakararimi.pdfIn PDF document text
- http://buyyoutubesubscribers.com/ci/userfiles/files/10128134801.pdfIn PDF document text
- http://vandervalk.reviews/app/webroot/files/userfiles/files/tewesejilixagi.pdfIn PDF document text
- http://clinicaveterinariacittadivignola.com/userfiles/files/98361922787.pdfIn PDF document text
- https://resttour.com/images/userfiles/files/76554218886.pdfIn PDF document text
- http://xinghui.co/upload/ckimg/files/202109050257247632.pdfIn PDF document text
- http://hyunbulsa.org/~ewedd2/userfiles/file/gixujutawefogelorakusimul.pdfIn PDF document text
- http://bhk-aindling.com/userfiles/files/22554604870.pdfIn PDF document text
- http://le383.com/uploads/files/zojosigariwubon.pdfIn PDF document text
- http://vnndt.com/Images_upload/files/kolakitolirinufur.pdfIn PDF document text
- http://studiogalata.it/userfiles/files/sarelitudu.pdfIn PDF document text
- http://ubestsports.com/imager/files/20210914125107.pdfIn PDF document text
- http://stluciachamber.org/uploadedImages/contentImg/file/34378898778.pdfIn PDF document text
- https://haisanquangninh.org/data/dulieu/files/kabikoxubobojoxazikekuj.pdfIn PDF document text
- https://khoahoc.timviec365.com/picturesfiles/10944754552.pdfIn PDF document text
- http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613264812d1c3---wekogobatasikapux.pdfIn PDF document text
- https://ecohort.info/userfiles/files/tidonuvijagij.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=golf+with+friends+apkPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_005_off0000e9b3.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xE9B3 | 19960 bytes |
SHA-256: ac08876647deefad3d4de744c40871a460399f4d9fccc8b3d87e1b2b902e6cc1 |
|||
font_00_sfnt_off0000b8aa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB8AA | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off0000d0c1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD0C1 | 10812 bytes |
SHA-256: 2f0c1d81118051e441db9cd6d7feeb756f5798772340dc8065140c671cebfe36 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.