MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous links to compromised websites, indicating a phishing or malware distribution campaign. The 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' heuristics confirm the nature of these links. The ML classifier and ClamAV detection further support the malicious classification.
Machine Learning
- Nyx PDF Classifier malicious score 0.8370
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://skipjackpoke.com/ckfinder/userfiles/files/kopagezetekinupa.pdf In PDF document text
- http://progfin.pl/userfiles/file/23925250874.pdfIn PDF document text
- https://glass-haus.ru/wp-content/plugins/super-forms/uploads/php/files/70b7392953992a98c5bf872e4184b8d9/talamivepizakugoga.pdfIn PDF document text
- https://www.infrascale.com/wp-content/plugins/super-forms/uploads/php/files/c5719e9ec354d930f57d9e81e96ceacd/lerajo.pdfIn PDF document text
- http://hz-kontejnery.cz/ckfinder/userfiles/files/jixizekosejelukumuxar.pdfIn PDF document text
- https://3dreamvr.com/wp-content/plugins/super-forms/uploads/php/files/aaa582581269a2739615593ae56e3934/laxivonidemuse.pdfIn PDF document text
- https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/16070b1d48d2e6---jimoxadagizugu.pdfIn PDF document text
- http://execdentalclinic.com/uploads/ckfinder/userfiles/files/mezozelow.pdfIn PDF document text
- https://mintedimages.com/ckfinder/userfiles/files/74468107041.pdfIn PDF document text
- https://xn--mgbaf4adbs1bd2i.net/upload/ckfinder/files/vilitukalirelumu.pdfIn PDF document text
- http://motivationandmomentum.net/ci/userfiles/files/baxefagonajex.pdfIn PDF document text
- http://arcdesantmarti.com/biocop/Images/images-editor/file/1562753749.pdfIn PDF document text
- https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/km26ij90l3ega31sb3b7ejdsj1/bapowiwux.pdfIn PDF document text
- http://mikomisushiwc.com/uploads/files/lujafinidunowipuxajizosi.pdfIn PDF document text
- http://www.driftime.ee/wp-content/plugins/formcraft/file-upload/server/content/files/160822019e426e---46035815218.pdfIn PDF document text
- http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160962bd96e51b---38912486947.pdfIn PDF document text
- https://egokituz.eus/files/galeria/files/telilevanujope.pdfIn PDF document text
- http://thetachikappasigmaalumni.org/clients/5/56/56ac51e2ee760b54d3ff8b7d53c877b7/File/58591115691.pdfIn PDF document text
- https://daaeportrett.no/upload/file/59119760037.pdfIn PDF document text
- https://www.pal-kont.hu/wp-content/plugins/super-forms/uploads/php/files/50da7c7d0665585bb1516b28707227ea/13258916871.pdfIn PDF document text
- http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ca554c398d---zojeretajugoxaro.pdfIn PDF document text
- http://ecilingirler.com/resimler/files/98203363092.pdfIn PDF document text
- https://www.lumisolar.pe/wp-content/plugins/formcraft/file-upload/server/content/files/160a978e20743a---bexak.pdfIn PDF document text
- http://thainightjob.com/ckfinder/userfiles/files/jekenakogipedesojuroliku.pdfIn PDF document text
- http://oilandgaswork.com/userfiles/file/xamugizilat.pdfIn PDF document text
- http://blankheich.de/images/uploads/file/25826033213.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/fzgW7-mxBc0/uplcv?utm_term=pet+farm+wild+animals+worksheet+for+kindergartenPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e9be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE9BE | 10980 bytes |
SHA-256: fcd252cfbc590db84476779e6812535438bac548f338b4710e6540e8e7a3e3cb |
|||
font_01_sfnt_off000102e6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x102E6 | 18768 bytes |
SHA-256: 375206aa31e8e10c95bf8b91934dcf6c63f9e951b9516a9ec46d9c74de5dc32f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.