MALICIOUS
144
Risk Score
Machine Learning
- Nyx PDF Classifier suspicious score 0.4992
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://sunuf.co.za/XSRYdR1H?utm_term=unlimited+nanas+hack PDF link annotation
- http://dreamsurgeryen.net/ckupload/files/34573430271.pdfIn PDF document text
- http://elsped.hu/files/file/10667662628.pdfIn PDF document text
- http://www.sindcomerciarioscs.org.br/adm/kcfinder/upload/files/vukozadal.pdfIn PDF document text
- https://aromamarketing.md/img/files/depurerovig.pdfIn PDF document text
- https://graveyards-fuj.ae/userfiles/files/velibopozubuvafukoro.pdfIn PDF document text
- http://demignyfasol.com/kcfinder/upload/files/38382476544.pdfIn PDF document text
- https://thietkeweblongan.com/upload/files/67718636164.pdfIn PDF document text
- https://szemere-iskola.hu/images/files/37954697620.pdfIn PDF document text
- https://www.auditek.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16201dbe1f2e94---46940394097.pdfIn PDF document text
- http://jia-longsofa.com/uploadpic/jialong151126/files/202203031749528599.pdfIn PDF document text
- https://tiad-mtm.com/assets/admin/js/plugins/kcfinder/upload/files/xujixosomakibewega.pdfIn PDF document text
- http://geoass.eu/userfiles/files/kilidoziza.pdfIn PDF document text
- http://salwex.hu/file/zuxikovakamisekeduxilum.pdfIn PDF document text
- https://ldoris.com/upfile/files/20220302141631.pdfIn PDF document text
- https://bozoklar.org/ckfinder/userfiles/files/movofasevapop.pdfIn PDF document text
- http://alkanboya.com/files/file///1053008515.pdfIn PDF document text
- http://messen.kellerdesign.de/userfiles/file/vuxusubadusib.pdfIn PDF document text
- https://charterboatdeliverance.com/uploads/files/47577049416.pdfIn PDF document text
- https://bennex.co.th/assets/kcfinder/upload/files/nebiwor.pdfIn PDF document text
- http://dentalcenterstudio.it/userfiles/files/8644022419.pdfIn PDF document text
- http://yeke.com.tr/public/kcfinder/upload/files/kolimavagig.pdfIn PDF document text
- http://klavierunterricht-bergedorf.de/files/files/68415313084.pdfIn PDF document text
- http://hunting.kg/userfiles/file/6026150549.pdfIn PDF document text
- http://zhihepvb.com/upload/ckimg/files/202203140406419928.pdfIn PDF document text
- https://www.fuji-chem.co.jp/admin/js/kcfinder/upload/files/29067837538.pdfIn PDF document text
- https://ag-concept.ru/wp-content/plugins/super-forms/uploads/php/files/7cc906972728a3023fb68d1c7356c35b/vivomezip.pdfIn PDF document text
- https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621418c4368dc---gugidajepebofuvufuwit.pdfIn PDF document text
- http://michelschuurmans.nl/images/uploads/file/50743914152.pdfIn PDF document text
- http://www.kickcommerce.com/userfiles/file/19503361545.pdfIn PDF document text
- http://pallenberg-busreisen.de/uploads/files/sagivugedopig.pdfIn PDF document text
- https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/qqsvpa848sj9ut2qmlthaeacdf/18617038027.pdfIn PDF document text
- https://pecel-piok.hu/images/files/jureketezigaxuvafukabizum.pdfIn PDF document text
- https://leunamgroup.com/wp-content/plugins/super-forms/uploads/php/files/3e3e302913d9078611e39c082f62b5f4/sofalifadajuta.pdfIn PDF document text
- http://pasarantogel2.com/contents/files/xivutowarijiwesozovamub.pdfIn PDF document text
- http://praxis-greve-polley.de/web/editor/files/80194645977.pdfIn PDF document text
- https://www.democratum.com/wp-content/plugins/super-forms/uploads/php/files/783a372ff7741f2afb7337a77e6d24b4/daxibiminaxu.pdfIn PDF document text
- http://formpart.com/upload/ckfinder/files/41555947955.pdfIn PDF document text
- http://for-man-woman.ru/userfiles/files/29133527429.pdfIn PDF document text
- http://s-privod.ru/userfiles/file/wepatutotulerazagorir.pdfIn PDF document text
- http://wp-supply.com/upimg/files/28633332006.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000447d3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x447D3 | 5720 bytes |
SHA-256: 7d54abc756819495c8c587b153123b092486d8976f5d1c2c54e4985356e39bd4 |
|||
font_01_sfnt_off00045bde.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x45BDE | 16336 bytes |
SHA-256: adf38969d40f501586e0caf93d33991e243baeeecfe575c4831cdbf64b7044fa |
|||
font_02_sfnt_off000471e1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x471E1 | 10512 bytes |
SHA-256: 128f30245ccba64fae074b26c75d2b56cb18cfdfbdf58072e75e2e1015c65333 |
|||
font_03_sfnt_off00048994.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x48994 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_04_sfnt_off0004a0b8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4A0B8 | 20600 bytes |
SHA-256: 04d7aff70b739aa4417c529ebe7142172698bb4c51a9396ef7f3b46eed06784f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.