MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many of which are hosted on compromised WordPress installations or disposable domains, suggesting a phishing or malware distribution scheme. The PDF structure itself is also noted as a link farm, further supporting this attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9970
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mudateconmigo.cl/wp-content/plugins/super-forms/uploads/php/files/8fd65bf2129dc09fca9b4d2e430764b8/pemawexovo.pdf
- http://assushop.com/userfiles/assushop.com/file/18720333167.pdf
- http://sinara.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8ad29706e---sopubazefovol.pdf
- https://marksiegeldds.com/wp-content/plugins/super-forms/uploads/php/files/7868a8718aaea6fee94811a4abc9d313/57450910250.pdf
- https://accesoriosalmayor.com/images/userfiles/file/mivigonejuzojelo.pdf
- http://cuakeobinhduong.com/upload/files/riliworewigal.pdf
- https://www.actionconstructionjax.com/wp-content/plugins/super-forms/uploads/php/files/ed8e276a8c463c947b99ae6f3b872be7/vowopabipu.pdf
- https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090fc220e0c4---vajekokoxa.pdf
- https://ladychief.com/wp-content/plugins/super-forms/uploads/php/files/2ec752422d3b1cab24aca60d0cab6941/95377291259.pdf
- http://www.redactordecontenidos.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160b076c532241---3891157300.pdf
- http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/1609531b83cd50---27193959247.pdf
- http://aleeblog.com/wp-content/plugins/super-forms/uploads/php/files/85b2r2u9rno4d9hri2g5mpsn45/40187072529.pdf
- https://gearforfree.com/wp-content/plugins/super-forms/uploads/php/files/hlumj7ihes2p1i5q3n64j4s860/69470454150.pdf
- https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/2ba0a7e7eb385d05609cea97f72af320/52142341324.pdf
- https://pametnidom.hr/pametne_kuce/userfiles/file/79684438244.pdf
- https://www.sanier.pl/wp-content/plugins/super-forms/uploads/php/files/aapp29mb9g4mor4s2gos8rflu7/47370433741.pdf
- http://ski-experience-japan.com/images/blog//file/kojeragezewezuwamekizagaz.pdf
- http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160706af9f2223---50329785227.pdf
- http://shsuorui.com/uploadfiles/fckeditor/20210624/file/16245586834516.pdf
- http://abwsalisbury.com/uploads/files/77661549962.pdf
- https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/e5a1d7c1b5107d0eca51501453421b7b/xuvodikagawisenawuzijabu.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=autobiography+of+rabindranath+tagore+in+english+pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1b8.binee78759a5f0fbc706f4a5c926b3cb384323af4a7d05a85817a9d229c5136fbd6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1B8 | 16804 bytes |
font_01_sfnt_off00011d3d.bin4b6a844e6bf7f2bc77674c661e8e9a4733a08e04761615ee52328c4778591d5e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11D3D | 11112 bytes |
font_02_sfnt_off000136b9.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x136B9 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.