MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.001 User Execution: Malicious Link
The sample is identified as malicious by ClamAV and contains numerous links to external websites, many hosted on compromised CMS platforms. These links are structured as a link farm, suggesting an attempt to direct users to potentially malicious content or phishing sites. No scripts were extracted, and the document body was unreadable, but the presence of a link farm and the ClamAV detection strongly indicate a malicious intent.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4491
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.jhannahs.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac530c2f7b6---vodogabipulizujutiredap.pdf
- http://aaaexpressheating.com/userfiles/file/65091268260.pdf
- https://xn--80adj7cxa.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/3e56f6b439bdcac801a490763edcb8f3/27401032677.pdf
- http://cnex.cc/images/blog//file/45634903144.pdf
- http://covinahigh1980.com/clients/1/14/147ee80f0cf2e08ca1b5067d21485a43/File/64449995698.pdf
- http://daimarconstrucciones.com/images/admin/file/levaz.pdf
- http://soldresold.com/Shradhdha-Mehra/soldresold/final/ckeditorimage/files/80280034782.pdf
- http://emirates-offshore.com/uploads/image/file/7309729011.pdf
- http://www.nanodrywash.com/wp-content/plugins/formcraft/file-upload/server/content/files/160979016d53e2---38828870274.pdf
- http://dabaizhongxue.com/upload_fck/file/2021-6-23/20210623135901140197.pdf
- http://www.chicagoalphas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089964345e2e---piropakax.pdf
- https://www.tanyadantus.com/wp-content/plugins/super-forms/uploads/php/files/01dc5165f0aabd91d1911856c94aea23/kewijulorunek.pdf
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd7f44b9fe7---xebesadirema.pdf
- https://saraelv.no/wp-content/plugins/formcraft/file-upload/server/content/files/16083e4eca1b43---besotokaxapesipalopu.pdf
- https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c1d3b0a506b---3163488613.pdf
- https://completecollegestrategies.com/wp-content/plugins/super-forms/uploads/php/files/4c36ca86628d31ae1ddc2688bbfc279b/waveletitavoravadugubaj.pdf
- http://esoftland.com/userfiles/file/82261910354.pdf
- http://nissanotogovap.net/uploads/images/files/poxexomemitenupop.pdf
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b4dec871d17---17563518216.pdf
- https://ekselantechnology.solutions/ckfinder/userfiles/files/37743973908.pdf
- https://saftanton.dk/wp-content/plugins/formcraft/file-upload/server/content/files/1608c19a36eb10---molelidarirajolinebot.pdf
- https://wpsqld.com.au/wp-content/plugins/super-forms/uploads/php/files/55a1e93a53a4c17c274b360667d0af2b/gabadamojib.pdf
- https://forkidsvietnam.vn/wp-content/plugins/super-forms/uploads/php/files/kj6h5eqahdfvp9r7obfrq3o2f1/fupigakaj.pdf
- http://abwrichmond.com/uploads/files/21481845484.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=gluttony+in+the+bible
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fe7b.bin9861f568bf1d2920cc812276077eaeedb0fd609a51315d62a568c5c6fb30e639 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE7B | 20000 bytes |
font_01_sfnt_off000132af.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x132AF | 16792 bytes |
font_02_sfnt_off00014ac6.bin92e316a1091c99085183d9bc3f0bc83d0b26bcf4f7c284e572c8df18eca75d67 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14AC6 | 10168 bytes |
font_03_sfnt_off00016177.bind08fad3dd2f5b286cc6bd095dae1de6b70dca1fe9182a6577b868c08808958c7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16177 | 16216 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.