MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file was detected as a phishing trojan by ClamAV. Static analysis revealed it functions as a link farm, containing numerous external URLs. Several of these URLs point to compromised WordPress upload directories, indicating a potential distribution point for malicious content or phishing pages. The presence of multiple links and the use of compromised infrastructure suggest a deliberate attempt to lure users to malicious sites.
Machine Learning
- Nyx PDF Classifier suspicious score 0.2680
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://chcial.ru/uplcv?utm_term=how+is+a+prime+number+different+from+a+composite+number PDF link annotation
- https://etravelbox.com/scgtest/team-explore/uploads/files/15167631799.pdfIn PDF document text
- http://mwbright.com/upload_fck/file/2021-9-7/20210907210055868475.pdfIn PDF document text
- http://citra.cl/userfiles/file/dixitedukirote.pdfIn PDF document text
- https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613eddb966dda---94534313466.pdfIn PDF document text
- http://hotelgiottotorino.com/userfiles/files/47228170736.pdfIn PDF document text
- http://cbestdesign.com/ckfinder/images_store/files/84056346166.pdfIn PDF document text
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613d7f606e08b---jevafuzib.pdfIn PDF document text
- https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/1612f0189a6552---45994080618.pdfIn PDF document text
- http://oticonshop.net/ckfinder/userfiles/files/32005596541.pdfIn PDF document text
- https://ville-saintleonard.fr/pdf/97731818492.pdfIn PDF document text
- http://ktcyy.com/ckfinder/userfiles/files/33176264130.pdfIn PDF document text
- https://dedywiredja.com/wp-content/plugins/formcraft/file-upload/server/content/files/16141b33edb024---90700299142.pdfIn PDF document text
- http://m3hotels.com/userfiles/file/bexafizamekopurajisiwe.pdfIn PDF document text
- https://brokenspoke.com/wp-content/plugins/super-forms/uploads/php/files/1c2d5a90539c1943117665a36505df73/72719855623.pdfIn PDF document text
- http://gibkrakow.pl/uploads/files/vedagupatafuxeti.pdfIn PDF document text
- https://ag-concept.ru/wp-content/plugins/super-forms/uploads/php/files/5e36a01e25ff77bf1970ddbd3c15f13d/25167326243.pdfIn PDF document text
- http://www.agrosystem.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1613cf35970f7b---fewovimerudilu.pdfIn PDF document text
- https://perfecthospital.net/FCKeditor/file/jomud.pdfIn PDF document text
- https://vialivonica.eu/userfiles/files/gesokotedeg.pdfIn PDF document text
- http://denda.co.kr/ckfinder/userfiles/files/makipadujigojipevozivini.pdfIn PDF document text
- https://suacuacuontoanphat.com/upload/files/bowatorobepunejinu.pdfIn PDF document text
- http://1mosref.ru/ckfinder/userfiles/files/88961460982.pdfIn PDF document text
- https://designmaster.in/scgtest/eec-new/codelibrary/ckeditor/ckfinder/userfiles/files/pifogetaji.pdfIn PDF document text
- http://yameitecl.com/ckfinder/userfiles/files/20210904_213650.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00011541.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11541 | 11052 bytes |
SHA-256: 30313f256e2a70f94ac73fd03153af141b0ddd68769e4b0c1fed6372e4468216 |
|||
font_01_sfnt_off00012ece.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12ECE | 19872 bytes |
SHA-256: 1d5ebe9f50aff52e3088a46194916a4b7592b214d0d38ce35e172813bf1eeafa |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.