MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a large number of links, many pointing to disposable hosting or compromised WordPress sites, indicating a link farm designed to distribute malicious content or phish users. ClamAV detected this as a phishing trojan. Although no scripts were explicitly extracted, the PDF structure and extensive URL usage suggest it's designed to lure users to external malicious sites.
Machine Learning
- Nyx PDF Classifier suspicious score 0.2722
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://allytemp.ru/uplcv?utm_term=pasta+n+more+instructions PDF link annotation
- http://studiophotosfashion.it/userfiles/files/wewupirirobukawi.pdfIn PDF document text
- https://thetitangroup.ca/wp-content/plugins/super-forms/uploads/php/files/7e3b81d97d4dd22ef25647028af35acc/65550834245.pdfIn PDF document text
- http://nhactheducthammy.com/upload/files/94355213422.pdfIn PDF document text
- http://jinruily.com/UploadFile/file/20210730191114844.pdfIn PDF document text
- http://extintoresorigen.com/images/editor/gelapibebetoriperoso.pdfIn PDF document text
- http://fishtech.org/uploads/userfiles/file/file/lezejaj.pdfIn PDF document text
- https://pharmnet.cz/ckfiles/files/files/kobebipudadik.pdfIn PDF document text
- https://travelsafeway.com/userfiles/file/21695368051.pdfIn PDF document text
- https://dodatnagarancija.com/userfiles/file/zufapaga.pdfIn PDF document text
- http://rufullthrottle.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608072fdd54a0---lumifufekobobakajiwusawos.pdfIn PDF document text
- http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b28663e0a3e---rivibitu.pdfIn PDF document text
- https://www.golaw.net/wp-content/plugins/formcraft/file-upload/server/content/files/16123465b1a663---55480992123.pdfIn PDF document text
- http://www.adatechotomasyon.net/wp-content/plugins/formcraft/file-upload/server/content/files/16088046f30713---34831559524.pdfIn PDF document text
- https://www.cr-sdc.org/wp-content/plugins/super-forms/uploads/php/files/4555c0b2c3434dc6564d2e59acbe6f4c/dototukadutigaxonipuvufex.pdfIn PDF document text
- http://www.a-fairys-choice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160716d51e2e8d---xozafedina.pdfIn PDF document text
- http://goldenrulelodge24.com/clients/860883/File/xezafabajake.pdfIn PDF document text
- http://lawcab.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160894ddb39ae7---8087221239.pdfIn PDF document text
- http://hanasushipickup.com/uploads/files/dazugemax.pdfIn PDF document text
- https://prairieroseclothiers.com/FCKeditor/file/54768630732.pdfIn PDF document text
- https://kolbandibileklik.com/resimler/files/78723917614.pdfIn PDF document text
- https://mavismanagement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c05f995e140---gujulurebunizezagu.pdfIn PDF document text
- http://gocreate.termall.pl/upload/fck/file/nanojijewowategefup.pdfIn PDF document text
- http://beckydavidsonhomes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608075c578059---vulow.pdfIn PDF document text
- https://gdr.co.il/wp-content/plugins/super-forms/uploads/php/files/fd373592cbededa2553c220d49bfdec7/34167044886.pdfIn PDF document text
- http://titadoorbinhduong.com/upload/files/402580317.pdfIn PDF document text
- http://allegroescrow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f7d73689a5---belede.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed77.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED77 | 10448 bytes |
SHA-256: 337a5e40aef490139f1ba077a5fc474a2775cefda8db0c7c1694a7f9cccda042 |
|||
font_01_sfnt_off0001052b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1052B | 17944 bytes |
SHA-256: 7032c85d306297c113c051e3e228baaa745b7222d1dba2088b37d37da1c29f83 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.