MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged by multiple heuristics, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. It contains numerous links to external websites, many of which appear to be hosted on compromised WordPress installations or disposable domains, suggesting a link farm or phishing lure. The ML classifier also indicated a high probability of maliciousness.
Machine Learning
- Nyx PDF Classifier malicious score 0.8531
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160749b0b87987---gisegidev.pdf In PDF document text
- https://www.marthatrotts.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16091d0053ede3---finuvulugarereb.pdfIn PDF document text
- http://kazenergy.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160c4be5f5df19---93594918388.pdfIn PDF document text
- http://neoclassicalmansions.com/uplds/file/sufaduripumi.pdfIn PDF document text
- http://srub-servis.ru/userfiles/file/luzujakaxobuwajigex.pdfIn PDF document text
- http://www.bestlifepolicy.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca0c0bf9ac---90156451186.pdfIn PDF document text
- https://sancarspune.com/wp-content/plugins/super-forms/uploads/php/files/4510c6768a554eddf4086efe26c61c3a/49379466154.pdfIn PDF document text
- https://hashtag.school/userfiles/file/bugiwufalinotiwitesofum.pdfIn PDF document text
- https://kalatranslation.co.uk/wp-content/plugins/super-forms/uploads/php/files/g6hgvntnmif74kin1f94g0q5sb/viwurigixajifebogeba.pdfIn PDF document text
- http://a-range.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16094763eb4a2e---29467758662.pdfIn PDF document text
- http://fvv-hohenfelde.de/sites/default/files/files/vuzotexibaxesisetij.pdfIn PDF document text
- https://tamtam.com.ua/wp-content/plugins/super-forms/uploads/php/files/75115ac6feb6ea122632b97c6e3a2c0c/37178584176.pdfIn PDF document text
- http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078f253795ab---77892955097.pdfIn PDF document text
- http://ominocoibaffi.it/userfiles/files/28802450521.pdfIn PDF document text
- http://digitalpolicycouncil.com/imagenes/file/9498478901.pdfIn PDF document text
- http://xn--80age2amlc.xn--80adxhks/pics/images/file/59954063756.pdfIn PDF document text
- https://keluargamimpi2.com/contents//files/filiwevodaxurizosisot.pdfIn PDF document text
- https://connect.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/6532132c5f100db143fa6a1bcefa52dd/94759672667.pdfIn PDF document text
- http://veterinariacomportamentale.it/userfiles/files/83334246213.pdfIn PDF document text
- https://www.truesdalepainting.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a48b61d419b---54354254003.pdfIn PDF document text
- http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6b97aafb3a---58285448972.pdfIn PDF document text
- http://studiogiovannone.com/userfiles/files/7614123813.pdfIn PDF document text
- http://mai-colle.jp/userfiles/file/56813540684.pdfIn PDF document text
- http://foto-klub.dk/userfiles/file/25771271539.pdfIn PDF document text
- http://dailyxedayhang.com/userfiles/files/30719325823.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=first+steps+in+academic+writing+2nd+edition+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002b369.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2B369 | 11100 bytes |
SHA-256: 56a9b67f726fc76af704f7b46dc7c5e3a26060c40f8201aea396fa2bd7815d9c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.