MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It functions as a link farm, containing numerous URLs pointing to compromised websites and potentially malicious PDF files. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' suggests a deliberate attempt to obscure the true destination by using disposable hosting and redirectors.
Machine Learning
- Nyx PDF Classifier malicious score 0.5366
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://whewfamily.com/clients/12004/File/15106098204.pdf In PDF document text
- http://mientaytourist.com/uploads/files/nuxisinenulopofipesa.pdfIn PDF document text
- http://fortlauderdalelimorental.net/wp-content/plugins/formcraft/file-upload/server/content/files/1608320916527e---dugijefigodumow.pdfIn PDF document text
- http://www.molinoag.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609912dc77641---buxonezezesoxexotokawap.pdfIn PDF document text
- http://www.webtony.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a17a10506ae---14662069782.pdfIn PDF document text
- http://highendschmiede.de/highendfiles/file/66030187925.pdfIn PDF document text
- https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/0fd687bec4ce129aa8a8f1ea83b8cff9/zejexizosozepibelenasar.pdfIn PDF document text
- http://bkbflooringusa.com/userfile/abbey/file/wibivofakovak.pdfIn PDF document text
- https://peptidturkiye.com/ckfinder/userfiles/files/wukiwagivop.pdfIn PDF document text
- https://www.accidentinjuryalbuquerque.com/wp-content/plugins/super-forms/uploads/php/files/lmokemvtaal412fodhngl66akk/kexosikipixozak.pdfIn PDF document text
- https://www.lightingdynamics.com/wp-content/plugins/super-forms/uploads/php/files/2a031a862e0c8e4337d6c7d7de4e1e94/14694305904.pdfIn PDF document text
- https://www.finestkindcharter.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f49320d621---womomulo.pdfIn PDF document text
- https://chetanaus.org/bheru/uploadfiles/file/33201568914.pdfIn PDF document text
- https://amd-export.com/site/upload/file/wanuparasawojitubupiri.pdfIn PDF document text
- http://audiomaster.se/wp-content/plugins/formcraft/file-upload/server/content/files/1607d9df7e5ed6---13023262524.pdfIn PDF document text
- http://lichnyiybrand.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1609cb5c0a0bd5---8397713636.pdfIn PDF document text
- https://cjsc.se/ckfinder/userfiles/files/45972742498.pdfIn PDF document text
- https://fermuar.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac42259ada3---najedejaziferavigebosomof.pdfIn PDF document text
- https://atlanthealth.com/wp-content/plugins/super-forms/uploads/php/files/3f1fb65caa0ad16f8903e759d83cc2b7/goxok.pdfIn PDF document text
- http://nensi.si/upload/file/dozoxevunu.pdfIn PDF document text
- https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b411e4a3e80---fodesegazivoniwaxarega.pdfIn PDF document text
- https://www.siemers-deutschmann.de/wp-content/plugins/super-forms/uploads/php/files/i1nksdiknnetfihqi5vr6evorf/wesimijobekogufuvus.pdfIn PDF document text
- https://microfocus-realize2020mea.com/wp-content/plugins/super-forms/uploads/php/files/2e2bda6691fd5480551745eed71e0883/fetozipajoren.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/6naE_Nh8_CY/uplcv?utm_term=physics+semester+1+exam+review+answersPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e10d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE10D | 10752 bytes |
SHA-256: 93bd8bca1f1bbe78d934439baea65d4828b6b324a9b5be8dcba4b5dfebe17896 |
|||
font_01_sfnt_off0000f9bd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF9BD | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_02_sfnt_off000111cf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x111CF | 17360 bytes |
SHA-256: 153673482a97760ee07c5a9f98bc952296f8b45393f392bdfe921772b1d2fe29 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.