MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.001 User Execution: Malicious Link
The PDF contains numerous external URIs and link farm patterns, indicating a likely attempt to direct users to malicious websites. The ML classifier and ClamAV detection strongly suggest malicious intent, classifying it as a phishing or trojan delivery mechanism. The document body is heavily obfuscated and unreadable, providing no direct content clues, but the heuristic findings are sufficient to infer a phishing or malware distribution attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9924
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://oniceh.ru/uplcv?utm_term=genderqueer+meaning+in+english
- https://www.gml.de/wp-content/plugins/formcraft/file-upload/server/content/files/16093d8ce40859---rugekorutezinobaxaxuvute.pdf
- https://amd-export.com/site/upload/file/99021028201.pdf
- https://whitelightdesign.com/wp-content/plugins/super-forms/uploads/php/files/c2bad934046330ae2791f1030724d7df/71534709509.pdf
- https://kantankacreative.com/wp-content/plugins/super-forms/uploads/php/files/7794e97d5c8af6308f92ddc898a3e7ba/58700390824.pdf
- http://inspirationallabels.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160b3c07b464a7---labinosodo.pdf
- https://seataclighting.com/wp-content/plugins/super-forms/uploads/php/files/7ff5c55c9569fa50287015dfa15b983d/vidoxugu.pdf
- http://photographybynami.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b70c5088dae---83567105765.pdf
- https://wentworthre.com/wp-content/plugins/super-forms/uploads/php/files/2ad2dc8777f30e4e66dbdc8ef2b426b0/nijijofixewelisisunavama.pdf
- http://broadviewlibrary.org/uploaded_bvlib/file/visovirerofa.pdf
- https://www.scilights.com/wp-content/plugins/super-forms/uploads/php/files/7e966e2d651aca28cad3425cfe18e1a8/5552749312.pdf
- https://www.lorenzofranzone.it/wp-content/plugins/super-forms/uploads/php/files/c243cb94466a4bca88781d5f01a739e9/90513697509.pdf
- http://maxitelt.no/wp-content/plugins/formcraft/file-upload/server/content/files/1608414df8760c---nejezesog.pdf
- http://www.mustwalge.ee/data/content/files/ruxezafux.pdf
- http://basyapiemlak.com/yukleme_klasoru/userfiles/file/gididimu.pdf
- https://hacunamatata.ru/wp-content/plugins/super-forms/uploads/php/files/0dccfd92d70b439509ccff888dec6f60/5812014060.pdf
- https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb351df2eea---verugelarepazide.pdf
- http://doggystylzgrooming.com/admin/photos/file/lulutugevovoxu.pdf
- http://bright-mineral.com/uploadfile/file/2021052017233286.pdf
- https://webgirls-studio.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609adae5f18cd---mapomidepuxova.pdf
- https://jakspravnenapsa.cz/userfiles/file/lanakujomijofuzosax.pdf
- http://cukiernia-waltar.pl/qcms/userfiles/file/difizi.pdf
- http://ansatrans.ru/admin/ckfinder/userfiles/files/dijegexuzufinu.pdf
- http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/16097026529ddc---3238592648.pdf
- http://iberryhomemade.com/userfiles/files/51162159534.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eb8f.binb939aa1ee617dd17a387f60e8012c01954af467f64c4030272be6123c34d8b7d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB8F | 18200 bytes |
font_01_sfnt_off00011be1.bin27024b122eba49fd3fc1c2d8f22afa726925bc898800408e683f1b37f97f45a1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11BE1 | 16120 bytes |
font_02_sfnt_off00013143.binfe7fce3506fe1c98498ba8b2124935b714734c3732a15d433480a445233e7db0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13143 | 10764 bytes |
font_03_sfnt_off0001493a.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1493A | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.