MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of links, many pointing to compromised CMS upload directories or disposable hosting, indicating a link farm designed to distribute malicious content or phish users. ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment. The document body is heavily obfuscated and unreadable, providing no direct user-facing lure.
Machine Learning
- Nyx PDF Classifier clean score 0.1876
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://alpha-cp.com/userfiles/file/71190410837.pdf In PDF document text
- http://www.onegelha.com/wp-content/plugins/super-forms/uploads/php/files/8cfba9f868e8feb48c9c4e2517b3b070/10299050582.pdfIn PDF document text
- http://www.florentmaussion.net/userfiles/File/22944031115.pdfIn PDF document text
- http://usmleworkout.com/files/file/fozosade.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a08fe242694---55064829417.pdfIn PDF document text
- http://xn--2vxr09c6mc.tw/CKEdit/upload/files/mivulikagejesupatipesuwu.pdfIn PDF document text
- http://ei-windykacja.pl/upload/file/53688929200.pdfIn PDF document text
- http://vetranhtuong.info/luutru/files/lasate.pdfIn PDF document text
- https://f1com.ge/wp-content/plugins/super-forms/uploads/php/files/4d7bad51d534eaa54f2bdcae17da33ad/93003398254.pdfIn PDF document text
- http://lubrifianti-auto.ro/files/file/fitabujexixebepusitobino.pdfIn PDF document text
- http://www.farparts.cl/wp-content/plugins/formcraft/file-upload/server/content/files/1606cdeea227d5---tatevezejudeboxufojonupim.pdfIn PDF document text
- https://rhdplumbing.com/wp-content/plugins/super-forms/uploads/php/files/575009e889ee9412fb5f6a2281ee27ff/92133505285.pdfIn PDF document text
- https://www.taxiserviceh24.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086af2f29dc9---64588056186.pdfIn PDF document text
- http://uci.ir/userfiles/file/87344123479.pdfIn PDF document text
- https://www.kadinlarsitesi.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c64c708af00---bapalawarotezapuj.pdfIn PDF document text
- http://tavernadelsnoguers.com/wp-content/plugins/super-forms/uploads/php/files/c1c300b8a6cb283de86db60b882d804b/zenovutanujejeb.pdfIn PDF document text
- https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be299137505---lositozaxelozomivul.pdfIn PDF document text
- http://reclaimsplus.com/wp-content/plugins/super-forms/uploads/php/files/4e0efc04910b6c49777b4569d3430918/74408922374.pdfIn PDF document text
- https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a94772d5b86---38302738174.pdfIn PDF document text
- https://tehnol.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607af73c265e6---rugovuwano.pdfIn PDF document text
- https://ddriu.hu/wp-content/plugins/super-forms/uploads/php/files/71216d2ef8c9f2ba414ea1e5195f96fa/20022391300.pdfIn PDF document text
- http://www.optionassurance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160c53c34f0b5c---jufutina.pdfIn PDF document text
- http://limpiasol.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2892c8e911---15144823523.pdfIn PDF document text
- http://coumert.com/images/file/menumevojubafadizev.pdfIn PDF document text
- http://ipvoicenj.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b5913ade6df---lukanif.pdfIn PDF document text
- http://arslanemlak.com/E/file/kiweda.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=postdoc+cover+letter+templatePDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012cb9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CB9 | 17296 bytes |
SHA-256: 203969defce2d1378a252440efe0ad276f47c1d78acdff1dfadda4e6f4ee107c |
|||
font_01_sfnt_off00015985.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15985 | 10544 bytes |
SHA-256: cacce57be217b1dd83568804768a64823a586983d74aacbf2d7b8e7995c4ff02 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.