MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged by multiple heuristics and a machine learning classifier as malicious, with ClamAV detecting it as Pdf.Phishing.Trojan. The file contains numerous links to compromised WordPress sites and disposable hosting, suggesting it is part of a link farm designed to redirect users to malicious content. The presence of embedded URLs and the nature of the heuristics indicate a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9935
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://studio45.live/wp-content/plugins/super-forms/uploads/php/files/m6djgaacpi6oga13m2810knsd5/valegapukijovuxozexakutu.pdf
- http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16094daad9813f---fogimata.pdf
- http://airconbank.com/upload/fckeditor/file/91922507069.pdf
- http://aci-immobilier-douai.fr/userfiles/files/39996081728.pdf
- https://www.sadcmedia.com/wp-content/plugins/super-forms/uploads/php/files/sujmhhero7dr13iad8dk6fd3vq/juniniteduxe.pdf
- http://grabnerestriche.at/693916185.pdf
- https://realwebguys.com/wp-content/plugins/formcraft/file-upload/server/content/files/160726729e0e6a---noxunidofefiz.pdf
- http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606c76d78def7---15531883137.pdf
- http://amphorabeautyclub.com/campannas/file/gitirunonusefufave.pdf
- https://miamivanservice.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a97c66b4838---85465946427.pdf
- http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160bbc08f784f4---97569566751.pdf
- http://www.assignproject.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608670c613e29---belinabet.pdf
- http://vincityhomes.vn/wp-content/plugins/super-forms/uploads/php/files/hhq2mbips173s9ck9tj5lpfoi0/venivaditofugar.pdf
- https://hssipm.com/wp-content/plugins/super-forms/uploads/php/files/1ee77adfac301a4b32510813ea846226/babejojurow.pdf
- https://brune-schmuckwerk.de/ckfinder/userfiles/files/5624115949.pdf
- http://vilaportugal.com/wp-content/plugins/formcraft/file-upload/server/content/files/16089feabe16ec---20409979273.pdf
- http://pwr-tech.ru/userfiles/file/burexomevilu.pdf
- http://ateliergermain.net/sites/default/files/file/gexikepuzam.pdf
- http://vistobrasil.net/uploads/file/2820904284.pdf
- https://buddingheights.org/wp-content/plugins/formcraft/file-upload/server/content/files/160781eeb9e2a5---xopuzidusuxejovenewilam.pdf
- http://metzpaintings.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a8e7a6688bb---51747905549.pdf
- http://anthonyvienna.com/sites/default/files/file/texazowupadejopod.pdf
- http://a-kamen.com/userfiles/file/55322403207.pdf
- https://thesaddlebank.com/wp-content/plugins/super-forms/uploads/php/files/8pavivgd8hl2231d8t1u7s6v5h/7924097284.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=i+was+subpoenaed+as+a+witness
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010940.bin5763be30d0ee596511ac10275f9ee16a29cd0bda33481b2b66376cc8587c760a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10940 | 17836 bytes |
font_01_sfnt_off0001385c.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1385C | 16792 bytes |
font_02_sfnt_off00015073.bin2515b44059007c76561184b36f11e3e99b78c1bc8eb4aaaf0bf504a2e9eb6bb9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15073 | 10516 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.