MALICIOUS
162
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains embedded JavaScript and a large number of links pointing to compromised WordPress sites, indicating a phishing or redirection attempt. The ClamAV detection and ML classifier further support its malicious nature. The embedded JavaScript likely serves to execute malicious code or redirect the user to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.5755
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://earthideasawnings.com/wp-content/plugins/formcraft/file-upload/server/content/files/1610f97af9ba5f---duduzikuvarelejanedopixiv.pdf In PDF document text
- http://bayzones.com/fckeditor/editor/filemanager/connectors/php/userfiles/file/wojiwurukidelezipupuzola.pdfIn PDF document text
- https://event-connections.net/wp-content/plugins/formcraft/file-upload/server/content/files/16098408b91090---ledevaviwa.pdfIn PDF document text
- https://growlocals.com/wp-content/plugins/super-forms/uploads/php/files/1dce533131fdfc458350e096613c4337/mijufanonujotirewan.pdfIn PDF document text
- http://swhwsolution.it/ckeditor-ckfinder-integration/uploads/files/86303942148.pdfIn PDF document text
- http://pulsrmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa0535187e1---18522627777.pdfIn PDF document text
- http://vikohasanfiber.com/upload/files/tamurip.pdfIn PDF document text
- http://www.kmclogistics.com/wp-content/plugins/super-forms/uploads/php/files/4806cd8932ee65c8d8b7acf45af00d00/87997128426.pdfIn PDF document text
- http://szguilong.com/userfiles/files/84189826150.pdfIn PDF document text
- http://terapie-psi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607e274090dae---wojekevajibezerizixe.pdfIn PDF document text
- https://bikinibody.be/wp-content/plugins/super-forms/uploads/php/files/q29u7349nfgi3dp7l0ilns50ht/vowunijurufekezujomi.pdfIn PDF document text
- http://pmdrecycling.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cc0516e9266---golusoxazasumefemix.pdfIn PDF document text
- https://majubesar.net/contents//files/lumagalijumetebidu.pdfIn PDF document text
- https://bishopsalamatkhokhar.org/userfiles/file/87150322909.pdfIn PDF document text
- https://afanasyev-design.ru/wp-content/plugins/super-forms/uploads/php/files/73f40b954ca705194567a997b46ee709/sopure.pdfIn PDF document text
- https://na-nule.ru/wp-content/plugins/super-forms/uploads/php/files/vnmbhperghqr6pjlng4mapk8s7/16375096352.pdfIn PDF document text
- https://bayardplaza.co.uk/wp-content/plugins/super-forms/uploads/php/files/verlijue6jtrf9spe0k96l9nf1/saponazabefobuja.pdfIn PDF document text
- http://melissajacksonmd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a03cc002b86---80166228367.pdfIn PDF document text
- http://mackyz7automotive.com/js/upload/files/5463219483.pdfIn PDF document text
- http://festivaldeliteraturadepereira.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c21caa4488f---pelunafupaze.pdfIn PDF document text
- http://nek.ua/wp-content/plugins/formcraft/file-upload/server/content/files/160b639f008713---15503083245.pdfIn PDF document text
- http://hy-concrete.ru/d/files/bilezuxalawumef.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=ejemplo+de+reporte+de+incidente+laboralPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c9b0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC9B0 | 10760 bytes |
SHA-256: 7dcc34df7fc709033e7b8e5dce8b3755abc140f684ad435a039d1fa395dd40f6 |
|||
font_01_sfnt_off0000e211.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE211 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.