MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains numerous links pointing to compromised WordPress upload directories and other disposable hosting, suggesting a link farm designed to distribute malware. The presence of external URIs and link farm heuristics strongly suggests an attempt to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9708
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.scanworld.se/wp-content/plugins/formcraft/file-upload/server/content/files/160ae94cf505a2---90378958631.pdf
- https://damsindia.org/admin/uploads/file/sagifukuvivonafi.pdf
- http://billsky.ee/files/file/giseromob.pdf
- http://ahcxdq.com/uploads/file/291410398742.pdf
- https://www.napariverinn.com/wp-content/plugins/super-forms/uploads/php/files/1efeb2cec824da2caf9a3b9dfa0cbff1/tifanurebumasuga.pdf
- http://www.gcsystem.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16092a7638726b---5975907114.pdf
- https://phase1acoustics.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfe1e107a25---tadivozuwesojisuza.pdf
- https://seroinstitute.com/wp-content/plugins/super-forms/uploads/php/files/165d8dbc6b3369545a0f9578158fb41e/33871668304.pdf
- http://schokozentrale.de/idata/34850695537.pdf
- https://teenvolunteer.org/wp-content/plugins/super-forms/uploads/php/files/59c0b72c9bd79ea8760014fbdcb15df5/57241999560.pdf
- http://chinasoftcore.com/userfiles/file///87542340029.pdf
- http://geteffective.biz/uploadfiles/file/36276685170.pdf
- https://wccia-vastu.com/wp-content/plugins/super-forms/uploads/php/files/15e000611831fc81933dfc8812b49879/funilenizugafifulokinu.pdf
- https://alkalacarservice.com/public_html/userfiles/file/sajatebelelikeximaso.pdf
- http://tfforming.ru/d/files/39191518413.pdf
- http://zonwering-nederland.nl/ckfinder/userfiles/files/42859830776.pdf
- https://chris-arnold.com/userfiles/file/sevasudijujaw.pdf
- http://www.k-24.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609ed0ca2b8ed---kifotexogidelomebulesameb.pdf
- https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/160ad34860de43---96878430034.pdf
- https://sgdivorcelawyers.com/wp-content/plugins/super-forms/uploads/php/files/9bfb713eacd379e1642036b6d7a3daf5/jadubemoname.pdf
- https://teenvolunteerdallas.org/wp-content/plugins/super-forms/uploads/php/files/dfe7f04a36149e5d6b6f6c27a5a3cac8/80213588399.pdf
- http://alternativefitness.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607c99ff4b739---71811175682.pdf
- https://www.asahinafunnels.com/wp-content/plugins/super-forms/uploads/php/files/595jmnoa4s06giiei4d5e7paot/lapomofireranoxa.pdf
- http://1970lions.com/clients/5/57/57eb30a5877ba0c7834658d164206012/File/26815558734.pdf
- http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082c1da797ef---tavexenojudunojezevubon.pdf
- https://noble-worldwide.com/wp-content/plugins/super-forms/uploads/php/files/4cdb0be70f4393b0bf73e87dccd33c17/58751486423.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BkSY9tpko7c/uplcv?utm_term=together+with+physics+lab+manual+class+12+pdf+free+download
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010e54.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10E54 | 16792 bytes |
font_01_sfnt_off0001266b.bin410a98f65097e31f8ca3fa161011a1a44563fb2d7f11b12c3e427107d1b98edf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1266B | 11640 bytes |
font_02_sfnt_off000141b0.bin55034f52d9168b6080a1c0b702b872e15486648c79fea3158d0222fe7ef503b8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x141B0 | 18336 bytes |
font_03_sfnt_off00016ff3.binb4d130bef9e63ab300a48868eb56824f3472307cc135b7d78c0e6a844ca4dbd3 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16FF3 | 5864 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.