MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1059.007 JavaScript
T1566.001 Spearphishing Attachment
The PDF contains embedded JavaScript, identified by the PDF_JAVASCRIPT heuristic, which is likely responsible for redirecting the user to external URLs. Several heuristics indicate the presence of link farms and compromised CMS uploads, suggesting a phishing or malware distribution scheme. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
JavaScript action low PDF_JAVASCRIPTPDF contains a /JavaScript action. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ap116.ru/userfiles/file/30720621429.pdf
- http://fitsiluet.cz/data/file/73465877028.pdf
- http://kwik-it.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160a72eadc6fe8---80551417218.pdf
- https://masterok-kovka.ru/wp-content/plugins/super-forms/uploads/php/files/0c16a8659ad07d05dea1f94ce64d31dd/65638542669.pdf
- http://www.libroparlatolions.it/backoffice/ckfinder/userfiles/files/maboxebokujekaworeliv.pdf
- http://www.peopleoftheheath.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b9a210478e0---samapazedovoku.pdf
- https://selectwifi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607405216803a---19023196145.pdf
- http://fundacjaproartis.pl/javascript/ckfinder/userfiles/files/kotanaj.pdf
- https://123kozijnofferte.nl/wp-content/plugins/super-forms/uploads/php/files/bopd8bpgjp556eqj957oq0c480/40155863534.pdf
- http://colantuono.it/userfiles/files/xusodalozurapomadorutixu.pdf
- http://dongfangguohua.com/ckfinder/userfiles/files/jopejevokofudasewe.pdf
- https://champion-osk.pl/userfiles/file/69076146762.pdf
- https://aawyx.com/sites/default/imageuser/file/xogokajedasixureda.pdf
- http://atek-ent.com/upload/file/92385630762.pdf
- https://divinesacredshakti.com/wp-content/plugins/super-forms/uploads/php/files/c2b1a3382d824c85d32e1005dceaba7c/891575646.pdf
- http://artmetinc.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610fb29f4913e---159353569.pdf
- https://oklogistic.lv/upload/file/56504593477.pdf
- http://futureinfashion.com/ckfinder/userfiles/files/26720864141.pdf
- http://manixcnc.com/ckupload/files/85607096747.pdf
- http://musorcentrum.hu/files/article/file/42113758603.pdf
- http://shuswapladystriders.ca/userfiles/file/faperesutuwurafuz.pdf
- http://amindoost.ir/images/upload/files/64949907208.pdf
- https://vongtaytramhuong.vn/upload/files/28474938910.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=growing+pine+trees+from+seed
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e4d2.bin13fffa839b5c549eb0f52c1c8a7467ed5d0b41c67b84f25eb45010df95cda97c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE4D2 | 17188 bytes |
font_01_sfnt_off0001112d.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1112D | 16792 bytes |
font_02_sfnt_off00012944.bind474e368ad3219b801dcdc2f879b5a8cacbbccf80bdc113fe9f731daeb73dd3f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12944 | 10760 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.