MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a link farm directing users to multiple websites, with several links pointing to compromised WordPress upload directories. The ClamAV detection indicates this is a phishing-related trojan. The primary attack pattern involves luring users to potentially malicious sites through a collection of links.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3721
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.playerclub.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc024e07b2---19139086601.pdf In PDF document text
- http://pvhs1967.com/clients/a/aa/aa78cb05297cd93d8a9ab6bd1eb8a3c4/File/dibatewowirofepujagugug.pdfIn PDF document text
- http://mrhobbscoffee.com/images/uploads/file/16634039390.pdfIn PDF document text
- https://bikeid.net/ckfinder/userfiles/files/xazejolagaxusejuk.pdfIn PDF document text
- https://tigercabinetry.com/wp-content/plugins/super-forms/uploads/php/files/901bfaec8a1587d96d34d055d47805e6/nemojutirewoz.pdfIn PDF document text
- http://npas.ru/pic/file/tuxupinok.pdfIn PDF document text
- http://haki.vn/uploads/files/67464805806.pdfIn PDF document text
- http://resortcrimea.com/ckfinder/userfiles/files/8157188397.pdfIn PDF document text
- http://eszixv.hu/ckfinder/userfiles/files/tuvitowinizulezamowi.pdfIn PDF document text
- https://hacunamatata.ru/wp-content/plugins/super-forms/uploads/php/files/c90eb39518db5054c4115578293b0618/nufuwo.pdfIn PDF document text
- https://tungafilm.com/dorceiys/ckfinder/userfiles/files/14304526324.pdfIn PDF document text
- https://vydavatelstvoklett.sk/userfiles/file/xitupupedujuw.pdfIn PDF document text
- http://waterreducer.cn/d/files/13015035619.pdfIn PDF document text
- https://psychotherapie-coeppicus.ch/userfiles/files/34785518082.pdfIn PDF document text
- https://glass-haus.ru/wp-content/plugins/super-forms/uploads/php/files/8866d01c89410d5e4aa6c71df00acc97/23587583020.pdfIn PDF document text
- http://shhs69reunions.com/clients/e/e9/e92da0bc0099326815942f81a5c18dfc/File/59570823019.pdfIn PDF document text
- http://tamilannuaire.com/var/www/vhosts/vps296430.ovh.net/tamilannuaire.com/images/file/lubabulowibidod.pdfIn PDF document text
- https://eliteswimmingpoolsinc.com/wp-content/plugins/super-forms/uploads/php/files/7vdk29dsb3ofvgptit7gh63si3/tixuserigoxo.pdfIn PDF document text
- http://magyaringatlanadatbazis.hu/dev/_user/file/58078595905.pdfIn PDF document text
- https://demo.wsbe17hongkong.hk/_bin/ckfinder/userfiles/files/repax.pdfIn PDF document text
- http://russia-ex.com/images/blog//file/55962557265.pdfIn PDF document text
- https://sbsoftware.ro/admin/userfiles/file/8673436585.pdfIn PDF document text
- http://seattleteriyaki3.com/uploads/files/durulazonakiz.pdfIn PDF document text
- http://mt-filtration.com/uploaded/file/607542009610a563a087bc.pdfIn PDF document text
- http://pericosrentcar.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/160897910c4940---kabaxesezimute.pdfIn PDF document text
- https://n-vv.dk/userfiles/file/motejaxag.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=star+wars+force+and+destiny+rulebook+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000edb5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDB5 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off000105cc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105CC | 11220 bytes |
SHA-256: 275ce280e37a73197e3ef72353b13046cfcbf8f40a2036e4ede1e636bca4618e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.