MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous embedded URLs, many of which point to compromised WordPress sites. Heuristics indicate this is a link farm designed to direct users to potentially malicious content. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious classification. No scripts were extracted, but the primary attack pattern involves luring users to external, compromised resources.
Machine Learning
- Nyx PDF Classifier malicious score 0.8532
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://dongytueduc.com/wp-content/plugins/super-forms/uploads/php/files/run61cqscnkv8qkqiqm8vrav20/37551702284.pdf In PDF document text
- http://changju-hotel.com/CKEdit/upload/files/gavalebalagivifasiwapu.pdfIn PDF document text
- https://vuaship.com/wp-content/plugins/super-forms/uploads/php/files/2s099olkvibmb3rsocrqqd8rpk/maxurapixaxotufop.pdfIn PDF document text
- https://ourcampuswindow.com/ckfinder/userfiles/files/puraguvojola.pdfIn PDF document text
- http://ngpsusa.com/wp-content/plugins/super-forms/uploads/php/files/m9bg6u91po7c2ieqsog16vdjet/34441779881.pdfIn PDF document text
- http://royalwedding.jp/images/blog//file/zumolafavagoburaxeb.pdfIn PDF document text
- https://baconbites.com/wp-content/plugins/super-forms/uploads/php/files/cr1gna22884cuoevrfl9b59mb6/zuzenu.pdfIn PDF document text
- http://kystop.com/wp-content/plugins/super-forms/uploads/php/files/ig1vsuo24j61c6vs8tp4mos5o6/jejokonuw.pdfIn PDF document text
- http://www.dnevi-sekretarjev.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160df1190dcd09---69776409135.pdfIn PDF document text
- http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/192c624d2ed87e128ca08c059969a524/lopiralurebenemifataga.pdfIn PDF document text
- https://earthideasawnings.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c724a865ec---tedatu.pdfIn PDF document text
- http://nnk.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160dd9f8fada5c---xelekiteboki.pdfIn PDF document text
- http://beamstraffic.ae/amb/userfiles/file/rerof.pdfIn PDF document text
- https://selispin.com/calisma2/files/uploads/mukatefapegupipixu.pdfIn PDF document text
- https://pluviaterra.mx/wp-content/plugins/super-forms/uploads/php/files/3f1b299558d7af1a52e7edcddd7cf8be/fujuvuxuwefozilelolujun.pdfIn PDF document text
- https://equipelec.fr/ckfinder/userfiles/files/nelovul.pdfIn PDF document text
- https://travolution.travel/wp-content/plugins/super-forms/uploads/php/files/262e6de73e839b53c25991b46b851232/mipoxinumonulevubew.pdfIn PDF document text
- http://ambvetbrashersclavoghisu.eu/userfiles/files/gunedenimajobugilejop.pdfIn PDF document text
- https://iominneapolis.com/wp-content/plugins/super-forms/uploads/php/files/cf8902e3c1a6ba9811854f9a7aba248b/1174819524.pdfIn PDF document text
- https://sheenabusesandcoaches.com/userfiles/file/91508207888.pdfIn PDF document text
- https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/366d34585fac85c8a97dd6825a05373e/86203345558.pdfIn PDF document text
- http://reiki-roots.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160ccef9941915---34007645750.pdfIn PDF document text
- https://www.dishdivvy.com/wp-content/plugins/super-forms/uploads/php/files/f323970a15262e6d9f9d2eedd1f8d758/bumoji.pdfIn PDF document text
- https://gccpay.net/wp-content/plugins/super-forms/uploads/php/files/d7664662f5e965fb29b48fca22ad3751/panopukenedododoperilu.pdfIn PDF document text
- http://easyliveconstruction.com/ci/userfiles/files/wozopovubaniti.pdfIn PDF document text
- https://aulacvn.com/upload/fck/file/37113119053.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=low+iron+but+not+anaemicPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d015.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD015 | 10460 bytes |
SHA-256: cc8c23948609e6fbc1199337c6395b114b53447ac70c5724731f786d52521fc7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.