MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links to external websites, many of which are hosted on compromised WordPress sites, suggesting a link farm or phishing lure. The presence of PDF_SEO_DISPOSABLE_LINK_FARM heuristic further supports this, indicating a non-clustered link farm on disposable hosting. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier malicious score 0.9942
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ca9fdbf3c5---41863062191.pdf
- http://archimax.ch/dynamic-images/cms/file/32832183676.pdf
- https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f042141eb19---27364907560.pdf
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086fa6bdb8f6---lavekorewazo.pdf
- https://www.enterpriselighting.com/wp-content/plugins/super-forms/uploads/php/files/1e21398e40d84000270b629156ea98dd/lifikapanorad.pdf
- https://www.partyshuttlebus.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160837f0025384---joledubemanasoroniditajuv.pdf
- http://www.sec-ollivier-associes.fr/www/upload/file/9186834498.pdf
- https://amalighting.com/wp-content/plugins/super-forms/uploads/php/files/fa2b2173e802e29a33034c27f31dc8b4/66788673509.pdf
- https://uclerbaklava.com/resources/file/35281204684.pdf
- https://notrepanierbio.ch/userfiles/file/madaxibojobinigonobe.pdf
- http://www.jcca.co.in/wp-content/plugins/formcraft/file-upload/server/content/files/1609f60aee93a7---77988812820.pdf
- http://steakclubhn.com/campannas/file/60071339572.pdf
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c97fd2eb43f---50969429543.pdf
- https://regenerativetherapyforpain.com/wp-content/plugins/super-forms/uploads/php/files/6fcc7410ac89f455581c6c814a7923b0/99790703762.pdf
- https://yesilkoyluleriz.biz/resimler/files/jeguk.pdf
- http://ne-moloko.ee/wp-content/plugins/super-forms/uploads/php/files/6d5d90bc50d592922c2848b3180154d3/momekemejibale.pdf
- https://ctapigroup3.com/contents//files/poxepirisugamegiroviz.pdf
- http://grupopiscis.com/upload/files/dunogolije.pdf
- http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f182ca20cb---bubemox.pdf
- https://forumhrdbekasi.com/webroot/userfiles/files/70946798366.pdf
- http://antoniolescio.net/userfiles/files/85436678747.pdf
- http://deltastal.ru/userfiles/file/97014173438.pdf
- http://www.naturapreserved.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e2c2b53139d---tifadagoz.pdf
- https://inclinedigital.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088bfdd13f58---11163669933.pdf
- http://halvani.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad460ab10db---nuwarumokijiru.pdf
- https://feedproxy.google.com/~r/Uplcv/~3/3CAf4wW3hvY/uplcv?utm_term=drooling+while+you+sleep
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f17d.binb153131dd8908781299f981f24cca2d8a42193d33e91c006a6f16a24412edf79 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF17D | 19736 bytes |
font_01_sfnt_off00012461.bin2d4496c695f411f2e2f75f16ff1e4f6234a2ad6d84b514cde1e73103d86784cb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12461 | 10572 bytes |
font_02_sfnt_off00013c73.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13C73 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.