MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a link farm pointing to numerous compromised websites, many of which host PDFs or use vulnerable CMS upload functionalities. ClamAV identified this as a phishing trojan, suggesting the links are intended to lure users into downloading malicious files or visiting phishing pages. The file's structure and the nature of the URLs strongly indicate a phishing or malware distribution campaign.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4578
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://acecaalcoy.com/userfiles/file/50053555099.pdf In PDF document text
- http://akinmedical.com/uploads/file/44504308554.pdfIn PDF document text
- https://g3az.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084b7acbee7b---51938437648.pdfIn PDF document text
- http://www.fattyweng.com.sg/wp-content/plugins/formcraft/file-upload/server/content/files/16075db27f00da---72804000228.pdfIn PDF document text
- http://fedoro.ru/upload/file/40572371884.pdfIn PDF document text
- https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/ae238fa196181db20908abfb2773c821/16648995128.pdfIn PDF document text
- https://www.brunosistemi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609bacab21a1d---wubufadeza.pdfIn PDF document text
- https://uaqbakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083f25c0972c---fazujofepesagutapuzize.pdfIn PDF document text
- https://absolut-fit-and-dance.de/wp-content/plugins/super-forms/uploads/php/files/oqdpb12f0nfsb6kutfdukvvsh1/73483807713.pdfIn PDF document text
- http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/27fd78ad7e6404a7843b36d09fc6612f/85896915724.pdfIn PDF document text
- http://aelma.com/sites/default/userfiles/file/15570232049.pdfIn PDF document text
- https://bluebeakbranding.com/wp-content/plugins/super-forms/uploads/php/files/17f436222ffe2091b2a260fe179812ea/28138539415.pdfIn PDF document text
- https://gz-topstar.com/wp-content/plugins/super-forms/uploads/php/files/ba82686864ee968403bb756404bcfee9/xogiso.pdfIn PDF document text
- http://manufim.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/1606fe54d25946---59552525534.pdfIn PDF document text
- https://condominiovillage.com/userfiles/file/7761050329.pdfIn PDF document text
- http://mastera-mix.ru/ckfinder/userfiles/files/lafas.pdfIn PDF document text
- http://www.absolutecateringla.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a524ed398d4---84720499981.pdfIn PDF document text
- https://costumeworld.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f286101674---zebajupoduzog.pdfIn PDF document text
- http://marthomaiticherukole.com/userfiles/file/nifewasojebipageki.pdfIn PDF document text
- https://marciasmithconsulting.com/wp-content/plugins/super-forms/uploads/php/files/e4aadb1872730b54bd501cad29cd8eca/vakala.pdfIn PDF document text
- http://cancercareresearch.com/userfiles/file/livawufatijamo.pdfIn PDF document text
- http://alexanderkanevskyartgallery.com/clientMedia/file/xuxotorubu.pdfIn PDF document text
- https://jjmassociates.com/wp-content/plugins/super-forms/uploads/php/files/6abecc9c545a51a028c674879c7b9146/33334091830.pdfIn PDF document text
- http://fbchitchcock.org/clients/8/8b/8bdff38a390027835eb24981312b950c/File/52292054562.pdfIn PDF document text
- http://mattstergamer.com/wp-content/plugins/super-forms/uploads/php/files/p089a3is668hfiuhfiuu5h1m8j/4509910150.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=some+funny+storiesPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e6bc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE6BC | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off0000fece.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFECE | 17104 bytes |
SHA-256: 7dd04c834b20b1eb1da495735f743ea892191c9610551ad7d09e4a0747de6f55 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.