MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains numerous embedded URLs, many of which point to compromised CMS upload directories, suggesting a link farm designed to distribute malicious content or phish users. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly supports this assessment. No scripts were extracted, but the structure and URL analysis indicate a malicious intent to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.5131
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://es-manzokudou.com/yamituki-n/uploads/files/mipuxufutula.pdf In PDF document text
- https://deitratech.com/userfiles/file/59780127713.pdfIn PDF document text
- http://training-solutions.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608bbc922008d---17476260723.pdfIn PDF document text
- https://controlcert.se/wp-content/plugins/formcraft/file-upload/server/content/files/160904b5f5900e---nekepubopilinovajopogewip.pdfIn PDF document text
- https://sonarmusic.hu/up_image/file/11575224631.pdfIn PDF document text
- https://asiaviews.org/wp-content/plugins/super-forms/uploads/php/files/bjl1uf18cf59kjkm5mmobn0oj0/22567133352.pdfIn PDF document text
- http://botosani.ro/img/uploads/file/55781265603.pdfIn PDF document text
- https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/5dc6fcfee052293ea64d4480aa7a2474/53512662900.pdfIn PDF document text
- https://balaji-technology.com/userfiles/file/bejemopopox.pdfIn PDF document text
- https://kindliving.org/wp-content/plugins/super-forms/uploads/php/files/tmp/xevexovawisobufitetafewid.pdfIn PDF document text
- http://bajcsidavidfoto.com/_user/file/ferujekotawabigufegatid.pdfIn PDF document text
- https://www.lowdoc-loans.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/16080b3a1570f7---lutizazosup.pdfIn PDF document text
- http://gocreate.termall.pl/upload/fck/file/22704683028.pdfIn PDF document text
- https://ivanda-commerce.hr/userfiles/file/mozivox.pdfIn PDF document text
- https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/aa1ea907e72dba0bbd17dad8f0001f9c/13884325392.pdfIn PDF document text
- https://na-nule.ru/wp-content/plugins/super-forms/uploads/php/files/2s6tskfrffjmthtmm4cg64elq5/muxabonevebipamixe.pdfIn PDF document text
- https://cometsecurity.in/admin/userfiles/file/xasotisajej.pdfIn PDF document text
- https://ceadersvalet.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f93bd2ced6f---5811105318.pdfIn PDF document text
- http://ednak.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c9f0a0d6ca3---20150839623.pdfIn PDF document text
- http://profisystem.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160882ee6f03d5---17496076354.pdfIn PDF document text
- http://cintabogor.com/Uploads/userfiles/files/fojifejosupur.pdfIn PDF document text
- http://www.euro-fly.eu/userfiles/files/24502086038.pdfIn PDF document text
- https://people11people.gr/uploads/File/darosenimelisofoginanov.pdfIn PDF document text
- https://coachtourbusrental.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd17b22b183---21651043653.pdfIn PDF document text
- http://www.roosprommenschenckelfoundation.nl/ckfinder/files/files/833595506.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=bible+quotes+telugu+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1cd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1CD | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off000109e4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x109E4 | 10748 bytes |
SHA-256: 2996358de92a2a9f88d1431262ea0554a3f14ad52dad6e82b3d85e451bb8e639 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.