MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file was detected as a malicious PDF by ClamAV and an ML classifier. It contains numerous links to external websites, many of which are hosted on compromised CMS platforms or disposable hosting, suggesting a link farm designed to redirect users to malicious content. The presence of PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics indicates a deliberate effort to obscure the final malicious destination. No scripts were extracted, but the overall structure points to a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.6772
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://csptech.net/admin/userfiles/file/4030545386.pdf In PDF document text
- https://accesoriosalmayor.com/images/userfiles/file/xizefasisenaxozaf.pdfIn PDF document text
- http://www.scmphotography.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160dac5a7920d5---20671475162.pdfIn PDF document text
- http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/160944fe0b58c5---kawavigovixapokinegazovaf.pdfIn PDF document text
- http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bf6f7b4431e---45352550862.pdfIn PDF document text
- http://sieckultury.pl/wp-content/plugins/super-forms/uploads/php/files/45853786148111aa1bdfbcb56d29555c/subizefelaterifad.pdfIn PDF document text
- http://recamonde.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b03b0e3478e---39213772447.pdfIn PDF document text
- https://earthchartercities.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609da24f0b2d3---galakexegalofapupodot.pdfIn PDF document text
- https://svetpoznaniyaonline.ru/wp-content/plugins/super-forms/uploads/php/files/7006c39829da1b3110f2f0c4c58ab99b/63533678943.pdfIn PDF document text
- https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/5db6df2a4238dcdb75d59bc963302793/menizata.pdfIn PDF document text
- http://rapabzenec.cz/obrazky/files/kuvudipokezodaxefabif.pdfIn PDF document text
- https://genericdiabeticteststrips.com/userfiles/files/33391794789.pdfIn PDF document text
- http://canhtoanland.com/upload/files/volusalupegosaziz.pdfIn PDF document text
- http://www.k-24.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d760a26e0c---kaxinideloduboruki.pdfIn PDF document text
- https://lightupalife.org.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607ca68c5c31b---5893197813.pdfIn PDF document text
- http://teplospectr.ru/images/files/tegumejin.pdfIn PDF document text
- https://forex-robo.org/wp-content/plugins/super-forms/uploads/php/files/fabbc981ba1aa0f9fafd6f75104e92a4/sinukegebedupom.pdfIn PDF document text
- http://circuitvietnamcambodge.com/hinhanh/file/42358471827.pdfIn PDF document text
- http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609c5069ade65---babifuvagerapeluf.pdfIn PDF document text
- http://parvazyab.net/basefile/api203/files/95679728499.pdfIn PDF document text
- https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/2c7e330438b93428e43539345fc61e21/88223584731.pdfIn PDF document text
- http://chieucoingason.vn/files/55867011125.pdfIn PDF document text
- https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/e5f0l2en4nu6at7onva9dv1gm3/55263537220.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=watch+the+barbie+diaries+online+freePDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f085.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF085 | 10704 bytes |
SHA-256: 939e7202c26c552386c73bd8f5b30d13c63b9cca6e4d4c0f5aebce80ee3b0e74 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.