MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains embedded JavaScript and links to external URLs, including one hosted on a compromised WordPress site. The heuristic 'PDF_SEO_UTM_REDIRECTOR_LINK' indicates an image lure linking to an SEO redirector, suggesting a phishing or malware distribution attempt. The presence of embedded JavaScript (PDF_JS) further supports the malicious intent, likely to execute further malicious code or redirect the user to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.6485
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lazav.co.za/XSRYdR1H?utm_term=2018+acura+tlx+navigation+manual PDF link annotation
- http://fabriziocar.it/userfiles/files/1639991806.pdfIn PDF document text
- http://nsfeed.com/_UploadFile/Images/file/41600724004.pdfIn PDF document text
- http://elmiraclassiccountry.com/wp-content/plugins/super-forms/uploads/php/files/4a90cc3cf49b2990a57bc81832686c4c/galetokemujajuwi.pdfIn PDF document text
- https://istanajp2.com/contents/files/xowojofijuxifaruxutapijiz.pdfIn PDF document text
- http://upakuika.com/img/file/17321915686.pdfIn PDF document text
- http://traviet36.com/upload/files/moragixelapezuremopo.pdfIn PDF document text
- http://www.atad.ae/emanager/assets/ckeditor/plugins/kcfinder/upload/files/92659665693.pdfIn PDF document text
- http://royalleasingny.com/admin/images/file/toxowuzujomeme.pdfIn PDF document text
- http://metabolitplus.ru/files/file/44417335564.pdfIn PDF document text
- http://zhihepvb.com/upload/ckimg/files/202202230513391674.pdfIn PDF document text
- https://bak.vn/upload/files/dojevimi.pdfIn PDF document text
- http://photomoments.ru/userfiles/files/tawexagufulij.pdfIn PDF document text
- http://saoz.sk/assets/kcfinder/upload/files/xawup.pdfIn PDF document text
- http://mas.vacations/wp-content/plugins/formcraft/file-upload/server/content/files/160e3e04dcbd06---bikoper.pdfIn PDF document text
- https://corumosmanlimakina.com/js/ckfinder/userfiles/files/xanawuluzo.pdfIn PDF document text
- http://littlepearlspublishing.in/data/eimages/file/jupujevapemuzaforozib.pdfIn PDF document text
- https://quizai.com/uploads/files/20923060673.pdfIn PDF document text
- http://ranaghatpchsschool.org/userfiles/file/kimunetex.pdfIn PDF document text
- https://leunamgroup.com/wp-content/plugins/super-forms/uploads/php/files/436740c4fb85e3ce23377e538f15369d/notuziwodijeruwij.pdfIn PDF document text
- https://eravukappalpalli.com/userfiles/file/4038947977.pdfIn PDF document text
- https://bbensonmft.com/wp-content/plugins/super-forms/uploads/php/files/d53eb5fe18c30b0a86b989ae0b246e88/sosipo.pdfIn PDF document text
- http://olapromos.com/ola/uploads/editorImagesfiles/36869139691.pdfIn PDF document text
- https://tomaszbizon.tomaszbizon.pl/web/uploads/files/10176721185.pdfIn PDF document text
- https://kicksomeglass.com/wp-content/plugins/super-forms/uploads/php/files/2a33573f5588fad842f343873c4f9647/49799209307.pdfIn PDF document text
- http://kaica.org.sa/ckeditor/kcfinder/upload/files/14599744026.pdfIn PDF document text
- https://actaviaserica.org/board/file/files/71493475593.pdfIn PDF document text
- http://kezheng.net/Upload/file/rudunidunotom.pdfIn PDF document text
- http://lpxs168.com/filespath/files/20210929184256.pdfIn PDF document text
- http://www.belladermeestetica.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1611dcc81a6199---zebazu.pdfIn PDF document text
- http://valaptop.com/ImagesVA/file/xejazexebagifowobun.pdfIn PDF document text
- https://arenerachicamocha.sinecsas.com/ckfinder/userfiles/files/viruraduveruzukexugumawe.pdfIn PDF document text
- http://kidilangues.fr/js/kcfinder/upload/files/52288709698.pdfIn PDF document text
- http://humansharehouse.com/userData/board/file/makixakupozikapig.pdfIn PDF document text
- http://msamericapageant.com/clients/873634/File/43002040063.pdfIn PDF document text
- http://chikatere.com/Upload/files/40477724477.pdfIn PDF document text
- https://nhatngudongkinh.com/upload/ckupload/files/naxivul.pdfIn PDF document text
- http://flightshop.jp/images/blog/file/12605606225.pdfIn PDF document text
- https://acethamessecurity.co.uk/wp-content/plugins/super-forms/uploads/php/files/29dbbc533e7efb2a817e1caaa2e8f1e5/jinukifugafugawoxud.pdfIn PDF document text
- https://sainaudit.mn/File/26131832731.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00056eb6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x56EB6 | 18260 bytes |
SHA-256: b2714fc044395cb6d795be2b0008d4fcf290df80c9a343d8c0aa6a4b5da593cb |
|||
font_01_sfnt_off00059ed1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x59ED1 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_02_sfnt_off0005b5f1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5B5F1 | 10944 bytes |
SHA-256: 792c86f4f6533e324fce6556eb835d0b604270eb7a3a5576c4c362efc5cdfa62 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.