MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It functions as a link farm, containing numerous URLs pointing to compromised CMS upload directories and disposable hosting. These links likely lead to further malicious content or phishing pages, indicating a phishing and potential exploitation attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9947
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://ildungrice.com/fileupload/fckeditor/file/fufililanepakipi.pdf
- https://gmonlinestore.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073e45f9336f---28808403786.pdf
- http://firegallery.ru/img/upload/52573808052.pdf
- http://gostium.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607623dfc8042---70685041076.pdf
- https://sellos-mecanicos.com/wp-content/plugins/super-forms/uploads/php/files/b15be2649328793dcd537148f7ae9725/vamapoxafakifubeva.pdf
- https://www.lashharmony.co.uk/wp-content/plugins/super-forms/uploads/php/files/9l9l0nbg2sllmlim7bu0tnvnom/sejuvulegekabozofipumexi.pdf
- https://aronabritcan.com/userfiles/file/40695100779.pdf
- http://statewideroadservices.com/clients/879378/File/melofuwibijebutezejuvuda.pdf
- https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/99c559b05aff279b71fd9cdb496e921b/madijawesuf.pdf
- https://www.kiteschule-eckernfoerde.de/wp-content/plugins/formcraft/file-upload/server/content/files/160bffb805155f---55258277112.pdf
- https://advik.net/userfiles/file/92387650934.pdf
- http://lncxjzxxw.com/upload_fck/file/2021-6-26/20210626070223358729.pdf
- https://hasekei.jp/userfiles/file/sajovewexuwi.pdf
- https://www.businesswatchguardingservices.co.uk/wp-content/plugins/super-forms/uploads/php/files/jpfsvqrnbscu5loevb9g6ovug6/lakosopo.pdf
- http://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c94d8dd6254---kosuzanusesekujukokozeb.pdf
- http://www.contectrade.hu/fckfiles/file/85103542575.pdf
- http://mijneigenlift.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16089acc3506d1---nipowazi.pdf
- http://vudafrique.com/wp-content/plugins/super-forms/uploads/php/files/af701a7f3f89457bfaa77a6aa491566e/43113180959.pdf
- https://www.cedicar.com/wp-content/plugins/formcraft/file-upload/server/content/files/16076b65c850e4---51980411463.pdf
- http://crystalnymph.by/wp-content/plugins/super-forms/uploads/php/files/b6eb4303fc3de81d9df4b289ab39472d/lebetugurabavozabilatezab.pdf
- http://www.ecostroyservis.ru/File/82276432036.pdf
- http://www.fliesen-brill.de/wp-content/plugins/formcraft/file-upload/server/content/files/16098a23b5c311---kovagafalimogul.pdf
- https://mymovingestimate.com/wp-content/plugins/super-forms/uploads/php/files/a9f9e54786e30d0e1c5653eac6435018/xuximopebosuxibikadupu.pdf
- http://www.goataxiservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609cb0ccf07ca---vilikedogotipage.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=air+sweeper+max+level+th8
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f791.binf0043b79a5d032ec3410a45dae8a4ae592e6f2402d38870e5f50054a9c23f119 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF791 | 16988 bytes |
font_01_sfnt_off0001240c.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1240C | 16792 bytes |
font_02_sfnt_off00013c23.bin642ae98712c019bdb7d25d4f67f8a3ef9bee3e0fd61896cd472adee9cb921be2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13C23 | 10736 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.