MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains numerous embedded URLs pointing to compromised websites, indicating a link farm or redirection scheme. The ML classifier strongly flagged this PDF as malicious, and heuristics identified it as a link farm on disposable hosting and potentially compromised CMS uploads. The primary purpose appears to be directing users to external, potentially malicious, resources.
Machine Learning
- Nyx PDF Classifier malicious score 0.9919
Heuristics 5
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://inwebjor.ru/uplcv?utm_term=what+is+a+plant+that+has+two+dominant+genes+or+two+recessive+genes+called PDF link annotation
- http://lorofilmes.com/Uploads/ckfinder/userfiles/files/5395894650.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095c6cb234cb---60853599897.pdfIn PDF document text
- https://puertoestereo.com/wp-content/plugins/super-forms/uploads/php/files/5s1ql7n69mtnjvs2gsjlq0nusu/vekazexavuxipudazije.pdfIn PDF document text
- http://daming-school.com/userfiles/file/85314958548.pdfIn PDF document text
- https://baodinhsolar.com/wp-content/plugins/super-forms/uploads/php/files/scr2lr3nfvr2mk017dt3ss8vg1/85886409662.pdfIn PDF document text
- https://www.andyselfstorage.co.uk/wp-content/plugins/super-forms/uploads/php/files/omdjvl3ccgat86bcpsanjp8fm4/45374721560.pdfIn PDF document text
- http://matstravel.ru/userfiles/file/zakufojevusirogopuvuvut.pdfIn PDF document text
- http://massageindex.nl/images/uploads/xeribavelevigulunujovajap.pdfIn PDF document text
- http://eko-inwest.eu/upload/file/25306777349.pdfIn PDF document text
- https://www.lenoir-elec.com/wp-content/plugins/super-forms/uploads/php/files/nc0flilet96627v74m7s8n4ku2/46033411544.pdfIn PDF document text
- http://magicdiscoradio.hu/userfiles/file/72598907890.pdfIn PDF document text
- http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b826d748b65---jiberifudatopabowit.pdfIn PDF document text
- https://www.prowallpanama.com/wp-content/plugins/super-forms/uploads/php/files/72ff0b45cf725f317d6e5e10db0f58d8/58698746665.pdfIn PDF document text
- https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/160758458408f1---jifeximigubowedamebubut.pdfIn PDF document text
- https://havanic.com/cache/fck_files/file/12496766501.pdfIn PDF document text
- https://www.mixedclass.com.au/wp-content/plugins/super-forms/uploads/php/files/hrg57pg1r85ul94vik7a4b5ata/30035644397.pdfIn PDF document text
- http://oasis-inwaste.asia/files/file/32677458515.pdfIn PDF document text
- http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607759787d0a9---malejopimewugo.pdfIn PDF document text
- http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9682455329---bezogobudorowifujizaku.pdfIn PDF document text
- https://harpethvalleypto.org/wp-content/plugins/super-forms/uploads/php/files/3321741716bc20051713fa7d9f515b0e/95438589279.pdfIn PDF document text
- https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/160c79b79c1b07---36864828020.pdfIn PDF document text
- http://ankurgroups.com/userfiles/file/badorikazuvebimadatadi.pdfIn PDF document text
- http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160be443f2da1a---26742878265.pdfIn PDF document text
- http://www.advancedevents.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607219b175f14---43287918536.pdfIn PDF document text
- http://vdgairconditioning.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160d1fd2ab5e34---rironosafogevovoxuguxabis.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00013549.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13549 | 11108 bytes |
SHA-256: 84b99ad13a7a92cf634f97e06e27082525487559f5b2b1656861a49355ce0f64 |
|||
font_01_sfnt_off00014ed4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14ED4 | 17700 bytes |
SHA-256: ccd3832c2f6dac309bb08f9577c7c0a2b69b9a29e4df6a4d540a51cc447a7742 |
|||
font_02_sfnt_off00017d02.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17D02 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.