MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The file is a PDF identified as malicious by ClamAV and an ML classifier. It contains numerous links, many pointing to compromised WordPress upload directories, suggesting it's part of a phishing campaign or malware distribution. The presence of a link to 'eduomania.com' hosting a PDF file further supports this, indicating a likely attempt to lure users into downloading and opening malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9766
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://awlights.com/wp-content/plugins/super-forms/uploads/php/files/88c2f3bb7bea8beff288c3e05922fdfe/73080256699.pdf In PDF document text
- http://derkwoo.com/upload/editor/files/rurutizazatemod.pdfIn PDF document text
- http://www.siscard.com/wp-content/plugins/formcraft/file-upload/server/content/files/160892791d1283---53120527562.pdfIn PDF document text
- http://aaaexpressac.com/userfiles/file/putebozega.pdfIn PDF document text
- https://www.hagensmarketing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b84dbf24890---33485123511.pdfIn PDF document text
- https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/neu3qfrag2g7e95h5dpjppk6cj/lobarub.pdfIn PDF document text
- https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075936db9f6e---34953111544.pdfIn PDF document text
- https://tonitomov.com/picture/file/3856285219.pdfIn PDF document text
- http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/j4tv64dvtrbh1knarmo5kk59l1/68775823594.pdfIn PDF document text
- https://engravestone.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d2987f5dedc---gikeju.pdfIn PDF document text
- http://apexhealthnutrition.com/newerac2c/userfiles/file/dilagikadobonedaxobub.pdfIn PDF document text
- https://www.harasportcenter.com/wp-content/plugins/super-forms/uploads/php/files/afv71fb7gk3vg47u2v9slae8c5/jalituwekadotiwekifopa.pdfIn PDF document text
- http://posekatzahradu.cz/files/file/rosulid.pdfIn PDF document text
- http://msnladyboy.com/ckfinder/userfiles/files/poladaxumatukovavidi.pdfIn PDF document text
- http://maility.pl_adresuserfiles/file/legoxijolidasevo.pdfIn PDF document text
- http://structurecreative.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072db3a36f0d---95769605037.pdfIn PDF document text
- http://www.norestim.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160a5daa620596---vikelegivebujemogala.pdfIn PDF document text
- http://ankaser.com/userfiles/file/32206178165.pdfIn PDF document text
- http://eduomania.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081c45f567ee---53552409680.pdfIn PDF document text
- https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/fajj56be2kq72a9n12lgdukf5t/fiserajakalebob.pdfIn PDF document text
- http://matrixuniverzum.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160cadf8a07edd---kozaxefafegidugotinudulum.pdfIn PDF document text
- http://thesetnews.com/images/fckeditor/file/sikilepukasolosukaja.pdfIn PDF document text
- https://www.enterpriselighting.com/wp-content/plugins/super-forms/uploads/php/files/c1e4b1622b34f7e8126faab6c4c6464d/75014192164.pdfIn PDF document text
- http://thegioidahoacuong.com/uploads/image/files/41251068275.pdfIn PDF document text
- http://broadviewlibrary.org/uploaded_bvlib/file/13682337140.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/ngfLrbzwjls/uplcv?utm_term=don+t+mess+with+my+toot+toot+meaningPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000408c9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x408C9 | 10608 bytes |
SHA-256: 0fd5e2447c4813cd82f0eda20ed5b2cb0b9dcc5c18808067b55fce509b913696 |
|||
font_01_sfnt_off000420f4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x420F4 | 18216 bytes |
SHA-256: 97e42c14349b706840b63e33ec9cdbb2358df425a3484aa450f293304b0211c1 |
|||
font_02_sfnt_off0004502e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4502E | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.