MALICIOUS
162
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains an embedded JavaScript stream and numerous URLs, many of which point to compromised WordPress upload directories or disposable hosting, indicating a link farm designed to redirect users. The ClamAV detection and ML classifier further support its malicious nature, likely as a phishing or malware distribution lure.
Machine Learning
- Nyx PDF Classifier malicious score 0.5832
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://bhk-aindling.com/userfiles/files/tizagujix.pdf In PDF document text
- http://svatba-emi.com/uploads/pages/files/24238796083.pdfIn PDF document text
- http://lyshiying.com/d/files/lebovafawomagewur.pdfIn PDF document text
- http://clinicaveterinariaalbese.eu/userfiles/files/93144806061.pdfIn PDF document text
- http://cetis156.neutronds.com/assets/js/ckfinder/userfiles/files/20169341246.pdfIn PDF document text
- http://kielcenoca.pl/files/file/tiwun.pdfIn PDF document text
- http://dreiseengrundschule.de/files/30187217091.pdfIn PDF document text
- https://studiogreenwich.ru/wp-content/plugins/super-forms/uploads/php/files/916b72aeed46080bd390b624a806fe9b/vajit.pdfIn PDF document text
- http://eperon-kochersberg.com/img_db/97120512554.pdfIn PDF document text
- http://cokhisah.com/webroot/img/files/85595781801.pdfIn PDF document text
- https://greshamgilessalon.com/wp-content/plugins/super-forms/uploads/php/files/6e7e16410ba9a3242533fa29e04b3df1/laluriw.pdfIn PDF document text
- http://moyamoya.center/images/hand_uploaded/files/jozivulaxixaj.pdfIn PDF document text
- http://midlandhigh65.com/clients/6/68/682e31fde28f8c6bff7ebba57332ef5f/File/43018855378.pdfIn PDF document text
- http://agriturismofattorialucciano.com/ckfinder/userfiles/files/zepagimowama.pdfIn PDF document text
- http://nicosiacaffe.it/file/73836854966.pdfIn PDF document text
- https://impariant-club.ru/wp-content/plugins/super-forms/uploads/php/files/ac980b115ba54f4d966a0d196e24b81e/4111396874.pdfIn PDF document text
- http://adveotec.com/img/file/42081801727.pdfIn PDF document text
- http://www.oneworldkarate.com/fckeditorimages/userfiles/file/xawotegalefem.pdfIn PDF document text
- https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/cc8b4dd333dc6ac743efe1a424320fe5/miwego.pdfIn PDF document text
- http://op-gold.com/ck_image//files/12476626031.pdfIn PDF document text
- http://www.pattyn360.com/upload/forum/files/loxiwunikavewifasesil.pdfIn PDF document text
- http://forspeed.cz/ckfinder/userfiles/files/90062570549.pdfIn PDF document text
- http://xn--80aaa1acmiejxr6d7fg.xn--p1ai/data/files/punufebijajematibibupajug.pdfIn PDF document text
- https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/paai5ju4kqpucnti2ch764vfc3/lubaxivogudigo.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/BvfzZFkJO3s/uplcv?utm_term=physical+anthropology+jurmain+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e1f1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE1F1 | 17544 bytes |
SHA-256: b010af9d3dcc5ddc4a55dd50ad3201f47e246d3a9be8d1a3d27a28b65225b027 |
|||
font_01_sfnt_off0001103b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1103B | 11280 bytes |
SHA-256: 4c32e943e431f8a62cedeb9da7a1ff2d09498e5a252e37c272cb9ee632fc82f5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.