MALICIOUS
216
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document is identified as malicious by ML classifiers and ClamAV, specifically as a phishing trojan. It employs a lure to trick users into downloading files by pretending to be a PDF conversion tool. The document contains numerous links to compromised websites, suggesting an attempt to host and distribute further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9999
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Recovery secret / private key request critical SE_SECRET_RECOVERY_LUREDocument requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://coretry.ru/uplcv?utm_term=encrypted+pdf+to+normal+pdf PDF link annotation
- https://arenda1s.ru/wp-content/plugins/super-forms/uploads/php/files/a9b75f96f9671fd3c2a265d54ef4369f/55536148955.pdfIn PDF document text
- https://www.apartamentselsllacs.com/wp-content/plugins/super-forms/uploads/php/files/2mlh96aa0oae8rfvk332huc615/nivakuvawulujisi.pdfIn PDF document text
- http://topas.lt/userfiles/file/natojuvoredaturimoli.pdfIn PDF document text
- http://gostium.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099ac129adcf---kezolidepedozov.pdfIn PDF document text
- http://www.phonefixcomo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bb69f70871---milebu.pdfIn PDF document text
- https://telewebmarketing.com/FCKeditor/file/65441559387.pdfIn PDF document text
- https://abril.pe/wp-content/plugins/super-forms/uploads/php/files/1lod39kk16gcqbibfirqeeen7t/14172844439.pdfIn PDF document text
- https://www.demetagras.com/wp-content/plugins/formcraft/file-upload/server/content/files/16074b4c4893ee---nefenegigamudoki.pdfIn PDF document text
- http://decom.pro/admin/ckfinder/userfiles/files/vamipo.pdfIn PDF document text
- https://ifacemount.com/wp-content/plugins/super-forms/uploads/php/files/ristablafbc74r5po5ebb2rpef/tukadenoridatilivifesujev.pdfIn PDF document text
- http://businessplan-capalpha.eu/mbp/upload/images/images/upload/ckfinder/46475512949.pdfIn PDF document text
- https://2greenchicks.com/wp-content/plugins/super-forms/uploads/php/files/c12d420e9d3c02a8fa4bd97ca84795f1/lejabagasifoku.pdfIn PDF document text
- https://www.kalirich.com/wp-content/plugins/super-forms/uploads/php/files/8a2q2eqami702db1j0kdd8uvo2/zutoperovafigonefubilamer.pdfIn PDF document text
- https://fiberglasssupplydepot.com/userfiles/file/letavazujag.pdfIn PDF document text
- https://www.mclarenpress.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b5af418d7d---rebizalasilavenu.pdfIn PDF document text
- http://stalmost.pl/userfiles/file/83595782502.pdfIn PDF document text
- http://adanateknikservis.web.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160c5415aa36f3---tepavikez.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e298.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE298 | 5180 bytes |
SHA-256: 8319aff55ba255d62d827db47dceb56bd343dcf24ffddcea9883b6f9742e6389 |
|||
font_01_sfnt_off0000f433.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF433 | 11476 bytes |
SHA-256: 51ffb4f519923c739504a8df2f136082dc16ff87ae1f8694d24bf3b34c2926a3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.