MALICIOUS
166
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.5595
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://loheb.co.za/XSRYdR1H?utm_term=cities+in+palm+beach+county+map PDF link annotation
- http://rusiuojigalvoji.lt/wp-content/plugins/formcraft/file-upload/server/content/files/1622af5d29a649---gexajetepil.pdfIn PDF document text
- http://opt-russtd.ru/data_center/upload_pictures/file/84119751475.pdfIn PDF document text
- http://studioagm.it/userfiles/files/31685831232.pdfIn PDF document text
- http://lezeckastenakosice.sk/upload/files/6594548434.pdfIn PDF document text
- https://abcoegypt.com/userfiles/files/93142072134.pdfIn PDF document text
- http://raduzhniy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16204a37de66ea---jolabuzijamilowudixeluju.pdfIn PDF document text
- http://www.hj-bouwt.be/wp-content/plugins/formcraft/file-upload/server/content/files/1622e69da7cfc0---voxidedelotuv.pdfIn PDF document text
- https://posetili.ru/userfiles/file/detebodolijokaxiguja.pdfIn PDF document text
- http://cissi.it/userfiles/files/vupejaju.pdfIn PDF document text
- http://azinsaghf.com/cache/fck_files/file/fowonumijeliralot.pdfIn PDF document text
- https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/tr1ai21v5n9nb01u9n3ukhun7k/dusamopuko.pdfIn PDF document text
- http://naszemotyle.natura2000.pl/imgturysta/files/73151514600.pdfIn PDF document text
- https://twojeloty.pl/admin/kcfinder/upload/files/tuwulegalinogat.pdfIn PDF document text
- https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1622f8f0b4a517---63194132039.pdfIn PDF document text
- http://tua-hatextiles.com/assets/ckeditor/kcfinder/upload/files/24436257152.pdfIn PDF document text
- http://shinhwajudan.com/userData/board/file/dixizidude.pdfIn PDF document text
- https://cqc-material.com/app/webroot/userfiles/files/zeruladipekufogesif.pdfIn PDF document text
- http://mindatpeace.us/uploads/files/nogegafuteboxuwifir.pdfIn PDF document text
- http://customartdirect.com/kcfinder/upload/files/15879105839.pdfIn PDF document text
- https://atarentacarburdur.com/userfiles/file/97825240499.pdfIn PDF document text
- https://yourwebcenter.com/files/file/26246060303.pdfIn PDF document text
- http://www.vyroba-plastovych-bazenu.cz/upload/files/69843991850.pdfIn PDF document text
- http://www.museopizarra.com/ckfinder/userfiles/files/59889001316.pdfIn PDF document text
- https://fac.apuntoweb.com/userfiles/files/2228679112.pdfIn PDF document text
- http://rcchoir.nl/upload/files/92273946010.pdfIn PDF document text
- http://gagutp.com/sa_upload/userfiles/file/20220209112931.pdfIn PDF document text
- http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/16215755a6358c---pebudo.pdfIn PDF document text
- http://canadianrockies.info/files/file/kirawasodugatus.pdfIn PDF document text
- http://upoart.com/ckfinder/userfiles/files/kidagujitogimodiwoboxon.pdfIn PDF document text
- http://hardevel.com/data/files/nixazunalu.pdfIn PDF document text
- http://skene.es/userfiles/file/83448400700.pdfIn PDF document text
- http://malabarisproducoes.com/arquivos/files/robazo.pdfIn PDF document text
- https://vivaldiroberto.com/img/files/mediafiles/file/xevakejosiwubol.pdfIn PDF document text
- https://buddingheights.org/wp-content/plugins/formcraft/file-upload/server/content/files/161fdf67aeecc5---demekubixapizuvun.pdfIn PDF document text
- http://393citizen.com/upload/files/titatu.pdfIn PDF document text
- https://hungarogun.hu/feltoltes/files/61845088357.pdfIn PDF document text
- https://advokati-ufa.ru/uploads/files/dozibafarekubovadivik.pdfIn PDF document text
- http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16217bfa473e3e---26955507977.pdfIn PDF document text
- http://shopgraeagle.com/ckeditor/uploads/files/zowijadatin.pdfIn PDF document text
- http://www.wiz-fac.com/uploadImg/file/rimevabaxatukirutalivil.pdfIn PDF document text
- https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/0dg4b53vi91l26igt5cb4lurag/13397093943.pdfIn PDF document text
- http://kedehg.com/ckfinder/userfiles/files/29833821947.pdfIn PDF document text
- http://www.toptehnik.si/images/gofalibebo.pdfIn PDF document text
- http://rutka.pl/media/upload/files/911b3bbb9aeb0620c02fae1d7e4dcdfe.pdfIn PDF document text
- https://www.tonygssoulfood.com/wp-content/plugins/super-forms/uploads/php/files/66add38ed26d1351a23eacc35948cd20/faxat.pdfIn PDF document text
- https://habibitours.org/ckfinder/userfiles/files/xubagoxobiz.pdfIn PDF document text
- https://ercrs.org/wp-content/plugins/super-forms/uploads/php/files/ana7iv4i4slh5efb7cncqgdu99/27972047310.pdfIn PDF document text
- https://maleki-group.ir/js/kcfinder/upload/files/83525809765.pdfIn PDF document text
- http://xn----8sbemnkjd7bfu.xn--p1ai/design/img/upload/file/gelajibeviporomarusi.pdfIn PDF document text
+9 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00055fbb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x55FBB | 10924 bytes |
SHA-256: 8e978c12afb2d0e5d45f330ca4ec0b5aac4d90c8f152cc5e9260dbc05759b03e |
|||
font_01_sfnt_off000578af.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x578AF | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_02_sfnt_off00058fce.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x58FCE | 19024 bytes |
SHA-256: 80dbfa6b0e827e4f7937c128abed9f2ea8d4bddddc93eb5c7f18614d02a9435b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.