MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.Trojan'. The file functions as a link farm, containing numerous URLs pointing to compromised WordPress sites. These links likely serve as lures for phishing attacks or to distribute further malware payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9960
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://dossalas.com/wp-content/plugins/super-forms/uploads/php/files/1a8fa1b264589ba667671953ede70c4e/67104210236.pdf
- https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/1314818caedaa35f183f910771ed833d/lozozupizikexolokuwaf.pdf
- http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086a590830f1---74481960510.pdf
- http://tribo.kz/userfiles/File/dugad.pdf
- https://greenturtleproductions.com.au/wp-content/plugins/super-forms/uploads/php/files/31a1627caf7b19f5c1771d9199da18f2/lirutuwoje.pdf
- http://www.petersmetalstitching.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160b28c9578f8a---49552379689.pdf
- https://www.asahinafunnels.com/wp-content/plugins/super-forms/uploads/php/files/ov47ra3sqpsi3cght2irjf1q46/jokedejebuvaxepofaluwi.pdf
- http://remontnoedelo.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160b78bfec7913---89767940606.pdf
- https://101doctor.com/uploads/ckfiles/files/60b7c82616091.pdf
- http://a2itsolutions.com/chop/multimedia/userfiles/file/26949470906.pdf
- https://cald-lighting.com/wp-content/plugins/super-forms/uploads/php/files/ee0e2413abf321628b702e1e0439c8e6/xotivatotoja.pdf
- https://travels-ukraine.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a00d0ba634d---wixuve.pdf
- https://www.zulilighting.com/wp-content/plugins/super-forms/uploads/php/files/adab1740032ec2c7e652a12d02d4922d/1673547501.pdf
- https://freedomtampons.com/wp-content/plugins/super-forms/uploads/php/files/c8422d2322215f027b06724a8db956e7/kufijuxizuxavavigojej.pdf
- http://www.kinoimaging.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160ba3c8591cfa---46921235249.pdf
- http://www.hangmandigital.com/files/file/47595052198.pdf
- https://www.webhisto.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160895ee765fa1---dujetonamo.pdf
- http://brixtontaxi.com/survey/userfiles/files/91173649909.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/DOqCt-cVA4I/uplcv?utm_term=unesco+general+history+of+africa+pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fe47.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE47 | 16792 bytes |
font_01_sfnt_off0001165e.binc3df913a36f3f1d47ee33cbb721cbb284a0063332b1af0e2d0a3bd70aca16afd |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1165E | 11020 bytes |
font_02_sfnt_off00012fbc.bin0f2c0e21de38fa440f6738b2677597ddc6e6075b5b38dd82fba60adf1aab871e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12FBC | 21504 bytes |
font_03_sfnt_off000165bd.bin5cfa37fce0989fcd98349beccf9a63719aff29e66b00f3ba655f54b68a91f5d5 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x165BD | 16120 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.