MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file contains numerous embedded URLs, many of which point to compromised CMS upload directories or disposable hosting, suggesting a link farm designed to distribute malicious content or phish users. The ClamAV detection and ML classifier further support its malicious nature. The primary attack pattern observed is the use of a link farm to redirect users to potentially harmful external sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.6966
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nomylo.ru/uplcv?utm_term=apps+math+solution PDF link annotation
- https://gites-les-bardots.com/userfiles/file/9605727189.pdfIn PDF document text
- http://www.k-24.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607859bc4ffe1---46593798716.pdfIn PDF document text
- http://i-biohealth.com/files/65288240350.pdfIn PDF document text
- http://orgue-chantepie.info/FCKeditor/upload/file/baratazokerome.pdfIn PDF document text
- http://www.ashtralmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071de74680c0---wekepileju.pdfIn PDF document text
- https://best-turbos.com/wp-content/plugins/super-forms/uploads/php/files/77e853b1310880c94e6cfa82a3134d56/62705350765.pdfIn PDF document text
- https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/2ed4210edb4b89366f98b4658c70c438/jedafojapetinitok.pdfIn PDF document text
- https://dalnoboy.com/data/filestorage/upload/files/bobex.pdfIn PDF document text
- http://bestforfishing.com/wp-content/plugins/super-forms/uploads/php/files/e8b17671b0f1b9a1571fd4759860bcfe/75779670354.pdfIn PDF document text
- http://ziepniekkalns.lv/wp-content/plugins/formcraft/file-upload/server/content/files/16097ba867ec06---39588645178.pdfIn PDF document text
- http://kondicionery-fryazino.ru/upload_picture/file/tunore.pdfIn PDF document text
- https://ecef-groupe.com/wp-content/plugins/super-forms/uploads/php/files/9so3jm03iuqbcl06jj7t2e10c5/43590356078.pdfIn PDF document text
- https://www.enviedecrire.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8e4923a564---vopesogidepi.pdfIn PDF document text
- https://balance-global.com/wp-content/plugins/super-forms/uploads/php/files/lh21v2tad6o7j6eus9orn77qoo/narozupi.pdfIn PDF document text
- https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bdb01b4c6ab---85826502088.pdfIn PDF document text
- https://stellabakingcompany.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bf8200124b---bawomidagadotazejagoj.pdfIn PDF document text
- http://foto-klub.dk/userfiles/file/rokazevumutozamuzemanisa.pdfIn PDF document text
- http://bioident.pl/photos_fck/file/zefavenaj.pdfIn PDF document text
- https://postscriptproductions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c19f14e240a---funopulugitijijotasem.pdfIn PDF document text
- https://www.hungryalex.com/wp-content/plugins/super-forms/uploads/php/files/ea95077c385bc92baeca7bfcddb9257d/pevivu.pdfIn PDF document text
- https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160907fb47dbe1---83825249576.pdfIn PDF document text
- http://compie.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16071cb8920b6e---gazepigokewumupimexij.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e610.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE610 | 10368 bytes |
SHA-256: 3aaf218580e458a1f84f42523f0e6c7627b7c13d823c49bb77502e3f2a8e9466 |
|||
font_01_sfnt_off0000fd49.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD49 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.