MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous links, many pointing to compromised CMS upload directories, suggesting it's designed to lure users to malicious content. The presence of a link farm on disposable hosting further supports this malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.6717
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfb57706754---57750730188.pdf In PDF document text
- https://irrisyst.eu/files/file/28708728473.pdfIn PDF document text
- https://geneticapanama.com/userfiles/file/bafosinekuroloroxalut.pdfIn PDF document text
- http://thefutureofgolf.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160c8c1aacf083---83272295224.pdfIn PDF document text
- https://arizonalightingsales.com/wp-content/plugins/super-forms/uploads/php/files/14ea859e81a9f0d6f50be0eb4dfe02f1/gulemejiwub.pdfIn PDF document text
- https://condominiobrisasdelnorte.com/userfiles/file/dekagevujiz.pdfIn PDF document text
- http://zhhyhb.com/uploadfiles/files/gotaxawuri.pdfIn PDF document text
- https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/160872946902a7---11604753400.pdfIn PDF document text
- http://www.predoisiasociatii.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160c58e57ece20---62208858357.pdfIn PDF document text
- https://kamber.dk/wp-content/plugins/super-forms/uploads/php/files/b9eeb7dc7d4bbc38cbb399a519e322db/kugosuwatozewugukam.pdfIn PDF document text
- https://cavalier-hundezucht.ch/userfiles/file/6386155517.pdfIn PDF document text
- https://tfnd.org/wp-content/plugins/super-forms/uploads/php/files/0f428daef6f0b68cc9a4aa4499cbaeff/28999319476.pdfIn PDF document text
- https://www.cdscabling.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160893f33d013f---25540501146.pdfIn PDF document text
- http://vasvaripalmuzeum.hu/upload/file/99975006587.pdfIn PDF document text
- https://kp-bs.ru/upload/files/xabipizuzegu.pdfIn PDF document text
- https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/b1d99ec9f8216e7eee4c37b563075a8f/kofexewelanu.pdfIn PDF document text
- https://assurancemauricie.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606da08d7afd1---27475195563.pdfIn PDF document text
- https://www.frankcapassoandsons.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac94d7353e2---nerefupepubani.pdfIn PDF document text
- http://www.altrus.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16094c998593d7---14216280899.pdfIn PDF document text
- https://lllk.ru/wp-content/plugins/super-forms/uploads/php/files/bcd07b7437b62bf63a729e274b328693/20163364271.pdfIn PDF document text
- https://noukos.gr/wp-content/plugins/formcraft/file-upload/server/content/files/16072629f5d3b4---58303267066.pdfIn PDF document text
- https://www.andrecampbell.ca/wp-content/plugins/super-forms/uploads/php/files/1fd599767b3764584ce9dabc94fa6b07/86565977823.pdfIn PDF document text
- http://healthywithhart.com/res/file/24449417611.pdfIn PDF document text
- http://abacusnancy.com/userfiles/file/69725923187.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=the+story+of+the+kindness+elves+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f752.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF752 | 10668 bytes |
SHA-256: 3ef03a51a7a71b244aecd31355611cb2ff662f03f49d527426ea5ac0049c75db |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.