MALICIOUS
226
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.6000
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Viral-video clickbait PDF links to suspicious host critical SE_VIRAL_VIDEO_CLICKBAIT_LINKDocument uses viral/leaked-video lure text and links to a suspicious disposable-looking web host. This is a clickbait/traffic-scam carrier shape rather than a benign PDF link.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://barrarioservicos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1611c4d1744498---99550395907.pdf In PDF document text
- http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/161c900c79e40c---podixukulafinedexus.pdfIn PDF document text
- http://ideviceplus.be/app/webroot/files/userfiles/files/13942353586.pdfIn PDF document text
- http://sibinetweek.ru/userfiles/file/68371564227.pdfIn PDF document text
- https://noks.cz/wp-content/plugins/formcraft/file-upload/server/content/files/162010ccd9bdec---kozatufupaboki.pdfIn PDF document text
- https://fibaquitaine.fr/cebatrama/userfiles/files/32613217969.pdfIn PDF document text
- https://senfina.top/uploads/files/viwuwupagokezajimeruride.pdfIn PDF document text
- http://hainescentreasia.com/images/file/jodixesaranixofejoruwel.pdfIn PDF document text
- http://autohondl.cz/userfiles/file/rilawefuzesazuzuzog.pdfIn PDF document text
- https://cutletsmeat.com/wp-content/plugins/formcraft/file-upload/server/content/files/16135f6b328d2e---50069230005.pdfIn PDF document text
- http://acetuitioncentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1618c3eee2cce3---dabipipe.pdfIn PDF document text
- https://stagelight.pl/userfiles/files/topebuvuxel.pdfIn PDF document text
- https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/161e1219f5e494---89072546969.pdfIn PDF document text
- http://briquettemachinery.com/d/files/31380153047.pdfIn PDF document text
- http://nadafashionbelt.com/Uploads/file/2782553331.pdfIn PDF document text
- https://dom4m.de/userfiles/files/rozaso.pdfIn PDF document text
- https://bkr.jetdesign.pl/files/files/25118856465.pdfIn PDF document text
- http://greddy.com/admin/common/ckfinder/userfiles/File/zifaxaxerelunafuvisif.pdfIn PDF document text
- http://www.truca-taoules.com//ckfinder/userfiles/files/xinedamafu.pdfIn PDF document text
- https://www.caposalasicilia.com/admin/ckeditor/kcfinder/upload/files/zisike.pdfIn PDF document text
- https://essuances.com/ckfinder/userfiles/files/batotagivijikilola.pdfIn PDF document text
- http://prochem.vn/images/uploads/files/sofudarixe.pdfIn PDF document text
- http://cnkls.com/userfiles/file/1627455052.pdfIn PDF document text
- http://edukoc.net/userData/ebizro_board/file/13751877892.pdfIn PDF document text
- http://www.videobezopasnost.ru/ckfinder/userfiles/files/54781378710.pdfIn PDF document text
- http://kondicionery-vidnoe.ru/upload_picture/file/50628936665.pdfIn PDF document text
- http://gardenofsound.com/userfiles/files/xosamijake.pdfIn PDF document text
- http://teplospectr.ru/images/files/55629553483.pdfIn PDF document text
- https://mgs-on-track.com/app/webroot/userfiles/file/winowafawififonafedalaxo.pdfIn PDF document text
- http://lahma.pl/_u/userfiles/file/birer.pdfIn PDF document text
- https://magyaringatlanadatbazis.hu/dev/_user/file/sofelatodeniwogulisokevus.pdfIn PDF document text
- https://dbmotorbrokers.com/userfiles/file/42099057569.pdfIn PDF document text
- https://ozsersogutma.com/upload/files/26013108637.pdfIn PDF document text
- http://thephinhmienbac.com/upload/files/mureb.pdfIn PDF document text
- https://dotcomtravelegypt.com/userfiles/files/77559829421.pdfIn PDF document text
- https://orderpoet.com/ckfinder/userfiles/files/84393119686.pdfIn PDF document text
- https://profbuhotchet.ru/wp-content/plugins/super-forms/uploads/php/files/28386cc6bb6cc0c857a31f69a5afd723/84105666736.pdfIn PDF document text
- http://christmaslandint.com/userfiles/faxakotape.pdfIn PDF document text
- http://www.farmaciapenil.es/userfiles/files/5901764723.pdfIn PDF document text
- https://loheb.co.za/XSRYdR1H?utm_term=assetto+corsa+competizione++freePDF link annotation
- https://artasedanasingaraja.com/uploadfck/file/41370246528.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00049cec.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00049cec.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00049cec.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x49CEC | 18376 bytes |
SHA-256: 0cde450e0aa7d39ae49011b1bd84c49c4eeebbdc38fb1eba087066452d1b7eaf |
|||
font_01_sfnt_off0004cb97.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4CB97 | 10636 bytes |
SHA-256: 4d3962ba2e1d72db1f219423c0a2085cd82457ae5d049f35aeac494a961d92b4 |
|||
font_02_sfnt_off0004e40a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4E40A | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.