MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The sample was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The presence of multiple links pointing to compromised WordPress upload directories suggests a phishing or malware distribution campaign. The document body is heavily obfuscated and unreadable, but the heuristics indicate it likely contains urgency or callback lures, common in phishing schemes.
Machine Learning
- Nyx PDF Classifier malicious score 0.8722
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
Urgency / deadline lure low SE_URGENCY_LUREDocument contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://kodeac.com/wp-content/plugins/super-forms/uploads/php/files/vm3vr6ap279votogdvpbndflfh/922002417.pdf
- http://manufim.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/160934e5a09260---bepafeno.pdf
- http://smolensk-bakaleya.ru/userfiles/file/92381800060.pdf
- http://www.holzbau-hoelzl.at/wp-content/plugins/formcraft/file-upload/server/content/files/16095e6f773040---91058154711.pdf
- http://www.virtualaid.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1609926d5057a3---xogezuxawezovafazezovise.pdf
- https://acrgroup.nl/userfiles/file/wovixevujodebotodisa.pdf
- http://lawyerstitleescrow.com/clients/9/9b/9b7cfcecb5e5abb6b877b2b1d59b4eb1/File/vogexumanogivutafevezo.pdf
- https://weyergans-hcc.lv/userfiles/file/17744635662.pdf
- https://t4g.nasscomfoundation.org/wp-content/plugins/super-forms/uploads/php/files/ja0rbqjmc2r08k85nbbsfj5ro2/juralumomolesajegowe.pdf
- http://podlahyadvere.sk/editor_uploads/system/files/vametulerewusikunonud.pdf
- http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/1606dea657667d---77951344668.pdf
- https://bestofbucerias.com/upload/file/38605050001.pdf
- http://www.consorcio.edu.pe/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1aced0bfe---29664371304.pdf
- http://srihemkuntsahibfgp.org/hemkunt/userfiles/file/30850234699.pdf
- http://www.afamaresme.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c0bb0f00124---49842580792.pdf
- https://bostoncake888.com/UserFiles/files/nomokojulagutezugoxejubu.pdf
- https://m-co.de/wp-content/plugins/super-forms/uploads/php/files/r9b6i17fg2dipbd8ithbrsehl1/josupedexetowefofixir.pdf
- http://harchovyk.com/userfiles/file/xesivotenarew.pdf
- https://www.capitalroofingct.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078b955126dd---78326161648.pdf
- http://ekotop.eu/userfiles/file/kadisuvi.pdf
- http://www.everhouse.lt/wp-content/plugins/formcraft/file-upload/server/content/files/160898f17a5cc4---wupokuvaxoset.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=jurisdiction+of+criminal+courts+in+inquiries+and+trials
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0006117d.bine5d515aba61c93b7dc6cc37454e2e155754897f808beb73ece32ad71f1943a3e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6117D | 17092 bytes |
font_01_sfnt_off00063e74.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x63E74 | 16792 bytes |
font_02_sfnt_off0006568b.bin4dd99bc927e61bca18a1988e91d73bfc0b3fab07ca320976e1da6a900ef8dfc2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6568B | 10876 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.