MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was detected as malicious by ClamAV and ML classifiers, indicating a phishing or malware distribution attempt. It functions as a link farm, with numerous embedded URLs pointing to compromised WordPress sites and disposable domains, likely intended to lure users to malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically highlights the use of disposable hosting and UTM parameters, further supporting the malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.5042
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://allytemp.ru/uplcv?utm_term=external+hard+drive+corrupted+ps4 PDF link annotation
- https://bf-pomosch.ru/wp-content/plugins/super-forms/uploads/php/files/2vaocp95g3cq541mhg6udhsiu0/33543637115.pdfIn PDF document text
- https://www.tanyadantus.com/wp-content/plugins/super-forms/uploads/php/files/7c330738292af0af063d95d9c244dede/kakowajololumu.pdfIn PDF document text
- http://www.annaleehuber.com/content_files/file/7431925649.pdfIn PDF document text
- http://palyavalaszto.hu/teszt/upload/file/rasazulonapareri.pdfIn PDF document text
- https://adepotcustom.com/UploadFiles/file/20210501100918132.pdfIn PDF document text
- https://skyzoan.com/cake/beta/userfiles/file/ditinemef.pdfIn PDF document text
- https://michaels-limo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cc12e0ba5c---jakafepebojawewonosabaxe.pdfIn PDF document text
- https://dixietemporarystorage.com/wp-content/plugins/super-forms/uploads/php/files/4910d195d58153bf3ee92fd4eb5c1422/nezakexejoritipovimokapiw.pdfIn PDF document text
- http://tktravel.shop/FileData/ckfinder/files/20210615_CA17E419DD5D737D.pdfIn PDF document text
- https://xn--64-mlcufjjaii0l.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/978b8b5942e1531a483c5cd9cbba6f14/nuwewagirogaxi.pdfIn PDF document text
- https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/i7d1l11qcog9libli6egj81lud/29715874416.pdfIn PDF document text
- http://lilit-realty.com/wp-content/plugins/super-forms/uploads/php/files/colch3jfa7usjqo1l2tsggbf05/tabisakudinasuwafato.pdfIn PDF document text
- http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609841bb63e76---dejetix.pdfIn PDF document text
- http://www.gradur.ba/wp-content/plugins/formcraft/file-upload/server/content/files/160b8434d80890---41044411755.pdfIn PDF document text
- https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/40etprvunq47su0ijse78i8c2r/pasonuzov.pdfIn PDF document text
- http://daiichibus.vn/uploads/news_file/80786830576.pdfIn PDF document text
- http://wjvanderheidedienstverlening.nl/uploads/file/66868304171.pdfIn PDF document text
- http://rosesrealtyhomes.com/userfiles/files/wasewojeve.pdfIn PDF document text
- https://gauravkankariya.com/wp-content/plugins/super-forms/uploads/php/files/44jh86j6jvm7v60hujbh08nkv4/75897444264.pdfIn PDF document text
- https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/160789159f1d3b---1706354495.pdfIn PDF document text
- https://rosemonttherapy.health/wp-content/plugins/super-forms/uploads/php/files/iehobr6g1s7ca8acjj4s691van/76589044335.pdfIn PDF document text
- https://www.rogierstoel.nl/wp-content/plugins/super-forms/uploads/php/files/iei5n9fudvh2h9kh5f066b7n72/98316117772.pdfIn PDF document text
- https://www.helmmsp.ca/wp-content/plugins/super-forms/uploads/php/files/e4a2686735f0eaa2ccb526a2033bc753/remawobonolezukuruf.pdfIn PDF document text
- https://www.areatransfers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d0c93079d6---88613455927.pdfIn PDF document text
- https://daluxerealty.com/wp-content/plugins/super-forms/uploads/php/files/np7skckbqakq3olik0q23tgeg6/656871488.pdfIn PDF document text
- https://m-isc.com/userfiles/file/fejafovewitusugakezoragi.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ed93.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xED93 | 10940 bytes |
SHA-256: e142052e71de48b7190b8c7af30321dc2a63566320b51609005bed93d66dc3ad |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.