MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF is identified as a phishing lure due to its image-heavy nature and embedded links, typical of attempts to trick users into navigating to malicious sites. The numerous links point to compromised WordPress upload directories, suggesting a distribution method for further payloads or phishing content. ClamAV detection and ML classification confirm its malicious nature.
Machine Learning
- Nyx PDF Classifier malicious score 0.8260
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 41 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608a36a4d8ed9---xuvinavemapazumutoxinad.pdf In PDF document text
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f27c3da402---laxasuwikejamez.pdfIn PDF document text
- https://expeditions-travel.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095deaab5af8---2312365381.pdfIn PDF document text
- http://freeski.hu/freeski/file/82758605610.pdfIn PDF document text
- https://buddingheights.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608f9fbc026c2---xomamuze.pdfIn PDF document text
- https://karapinarinsaat.net/userfiles/upload/file/xafenugetogimoliri.pdfIn PDF document text
- http://omniatel.it/wp-content/plugins/formcraft/file-upload/server/content/files/1606d61494cc10---pegizosawabakofabebar.pdfIn PDF document text
- https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/27141205da33db4f3dd1e7caef7aea5e/11989156656.pdfIn PDF document text
- https://fultoys.com/userfiles/97875536517.pdfIn PDF document text
- http://ridendo.cz/files/file/kawulazapopupo.pdfIn PDF document text
- https://action-roofing.com/wp-content/plugins/super-forms/uploads/php/files/38d2877865d5552405f78a9f433a6847/zonob.pdfIn PDF document text
- http://stardentalcare.org/userfiles/file/sumijotilovaximesatir.pdfIn PDF document text
- http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608c224d8c21f---43378074647.pdfIn PDF document text
- https://tecnibat.net/uploads/archivos/juxakekuwajivegasova.pdfIn PDF document text
- http://21cedu.com/pds/userfiles/files/xibakoxulutukemod.pdfIn PDF document text
- https://earplighting.com/wp-content/plugins/super-forms/uploads/php/files/4b2e21f1765b0fd270edd07517b6e618/24815303254.pdfIn PDF document text
- https://leunamgroup.com/wp-content/plugins/super-forms/uploads/php/files/a001e364b8af4ae3b1d51f7e2239f6db/rukexududisafa.pdfIn PDF document text
- https://www.helpfulhunks.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607eea14cc1a7---furopifudikijiw.pdfIn PDF document text
- http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160c8eeec2d1e4---92116025375.pdfIn PDF document text
- http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609f290ec346f---75866994286.pdfIn PDF document text
- https://www.aceitedeoliva.com/wp-content/plugins/super-forms/uploads/php/files/15101270276625d7949a4da8ceacdee7/zatumosefu.pdfIn PDF document text
- http://www.hollyskauaicondo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160771c1db49bd---jekofufinajejile.pdfIn PDF document text
- https://avenirpourtous.fr/wp-content/plugins/formcraft/file-upload/server/content/files/16087d192d8c14---69015641086.pdfIn PDF document text
- http://www.finanzanlagen-honorarberatung.de/wp-content/plugins/formcraft/file-upload/server/content/files/16082cfa75bd0f---87882201927.pdfIn PDF document text
- https://www.officinadelgustoroma.com/wp-content/plugins/super-forms/uploads/php/files/7e613b3d000c9440b4154f5ee6d8fec6/jevitodatakegof.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/6naE_Nh8_CY/uplcv?utm_term=fionnula+flanagan+movies+and+tv+showsPDF link annotation
Open this report in the interactive analyzer, or submit your own file for analysis.