MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded URLs, many of which point to compromised WordPress sites. The ClamAV detection indicates it is a phishing trojan. The file's structure and URL distribution suggest it is designed to lure users to malicious content, likely for phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier clean score 0.2445
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://webmodeli.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e346584a8c1---8988167374.pdf In PDF document text
- http://www.guaitoli.eng.br/wp-content/plugins/formcraft/file-upload/server/content/files/1610074adde809---mudutufepixipiturupogased.pdfIn PDF document text
- http://www.miamiairportlimo.net/wp-content/plugins/formcraft/file-upload/server/content/files/160bfcb0ccdf73---zovutilusudekalisotajat.pdfIn PDF document text
- https://mekongtransport.com/upload/userfiles/files/54428656978.pdfIn PDF document text
- http://donkaew-furniture.com/ckfinder/userfiles/files/rigumem.pdfIn PDF document text
- http://bebsulmare.com/userfiles/files/10412015320.pdfIn PDF document text
- https://www.crossfitparamaribo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e0529527576---24844012800.pdfIn PDF document text
- https://100tmt.com/uploadimage/files/20210708122238.pdfIn PDF document text
- http://maxitelt.no/wp-content/plugins/formcraft/file-upload/server/content/files/1612355cac6f23---razepijokegogamedap.pdfIn PDF document text
- http://xn--dlek-5qa.com/admin/UserFiles/file/77986475257.pdfIn PDF document text
- http://adabaskimerkezi.com/upload/file/56649662999.pdfIn PDF document text
- http://scpt.it/userfiles/files/58255169513.pdfIn PDF document text
- https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/4b1b1143b07f7351428d3bce755f2bfe/jovosudaketojigosurisupe.pdfIn PDF document text
- http://www.sunaryem.com.tr/wp-content/plugins/super-forms/uploads/php/files/ebvsgrt9s0r6a1mk06ga0g2010/33453505721.pdfIn PDF document text
- https://www.partyshuttlebus.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1609d1d3539e8c---45737190782.pdfIn PDF document text
- http://bethelhanberryaaa.com/clients/2/24/2465ef4bb9bb1b7382310ae17d7cafeb/File/2283643683.pdfIn PDF document text
- https://www.mysmilestudios.com/wp-content/plugins/super-forms/uploads/php/files/ab8aa3c576b43370fd9fd946a9df03f2/gopiw.pdfIn PDF document text
- http://trenermichal.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1607adf25c657a---lekopekapiposu.pdfIn PDF document text
- http://terezmisszio.eu/files/file/xitoloxijuxidot.pdfIn PDF document text
- http://www.yeosung21.or.kr/ckfinder/userfiles/files/1627192865.pdfIn PDF document text
- http://wchs67.com/clients/f/fd/fd50fd9748f3592dabdfdad26f378f15/File/ragunepe.pdfIn PDF document text
- https://mintowncoffee.net/uploads/images/files/vamotawevid.pdfIn PDF document text
- https://dispomydeal.com/wp-content/plugins/super-forms/uploads/php/files/753cfa7b19a92294997475c4cfc04392/89088295454.pdfIn PDF document text
- http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e145a5124c---vezeworasirotulexi.pdfIn PDF document text
- http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/160783e9ece89b---wisiwirovum.pdfIn PDF document text
- http://xn--aknmedcal-wpbe.com/uploads/file/nutividuvovodosefule.pdfIn PDF document text
- http://tplustech.com/images/ckeditor/files/tonunafoz.pdfIn PDF document text
- https://atolab.it/wp-content/plugins/super-forms/uploads/php/files/2baa6b77c80dd672debe08e5000d2748/46868619996.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=siemens+plc+300+manualPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ca42.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCA42 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off0000e259.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE259 | 10684 bytes |
SHA-256: f3f5b04a3e2a872a140bd0db6b41c7fea024e1ef08ad1dea9564b1c4b1569963 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.