MALICIOUS
166
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.7170
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lazav.co.za/XSRYdR1H?utm_term=blast+furnace+guide+osrs+reddit PDF link annotation
- http://sbs-group.co/userfiles/files/dagito.pdfIn PDF document text
- https://nocrime.cntwn.org/ckfinder/userfiles/files/2685324900.pdfIn PDF document text
- https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/16116b134b19b9---34329861997.pdfIn PDF document text
- http://goodtraefarm.com/ckupload/files/bajateke.pdfIn PDF document text
- http://xageunion.com/userfiles/file/51840875190.pdfIn PDF document text
- https://implant-drill.com/userfiles/file/91137003465.pdfIn PDF document text
- https://hohsingfiber.com/ufiles/files/21789121793.pdfIn PDF document text
- http://wideanglepackaging.com/ckfinder/userfiles/files/12689261731.pdfIn PDF document text
- http://knx-shop.ru/admin/ckfinder/userfiles/files/resugetumofibixovikujuz.pdfIn PDF document text
- http://compagniaviaggi.gattinonimondodivacanze.it/themes/userfiles/files/baxojudutovuxutek.pdfIn PDF document text
- https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1619ca786b5c6e---lebotezumati.pdfIn PDF document text
- https://apsco.ly/userfiles/files/garewefufalagava.pdfIn PDF document text
- http://fkm-lux.by/var/upload/file/8929337157.pdfIn PDF document text
- https://bodykneadstherapy.com.au/ckfinder/userfiles/files/bozipu.pdfIn PDF document text
- http://robvancampen.nl/userfiles/file/55631177196.pdfIn PDF document text
- http://greatwalledmond.com/ckfinder/userfiles/files/68346244343.pdfIn PDF document text
- http://lycee-elm.org/userfiles/file/kinituxex.pdfIn PDF document text
- https://www.opdrrustukalac.com/wp-content/plugins/formcraft/file-upload/server/content/files/1616a7cde331d8---xutazodofepomif.pdfIn PDF document text
- http://dui-antidote.com/images/userfiles/file/13601680846.pdfIn PDF document text
- https://hpx.com.ua/wp-content/plugins/super-forms/uploads/php/files/a51c0d162bf5895d9187addb8e6406a5/93452704381.pdfIn PDF document text
- http://stapper.de/sites/default/files/userfilesfile/kulolusupugugakepuxetela.pdfIn PDF document text
- http://tea-ra.com/user_data/upload/save_image/files/19960169657.pdfIn PDF document text
- https://pensiuneavalentina.ro/app/webroot/file/79514273884.pdfIn PDF document text
- http://redigonda.it/userfiles/files/65773815724.pdfIn PDF document text
- http://jiachuankeji.com/upload_fck/file/2021-11-17/20211117082911225108.pdfIn PDF document text
- http://discoveryenglish.org/wp-content/plugins/formcraft/file-upload/server/content/files/161ca98eccd725---48014445552.pdfIn PDF document text
- http://loaamtran.vn/files/usersfiles/files/fobofumijugumosunijodunel.pdfIn PDF document text
- https://www.inter-tube.co.uk/wp-content/plugins/super-forms/uploads/php/files/d27ef7eda3bde5d7cb7d49ad123a4ea6/lefaburolidilemi.pdfIn PDF document text
- https://ecodiagnost.com/ckfinder/userfiles/files/24208131421.pdfIn PDF document text
- http://www.granito-terrazzo.be/ckeditor/kcfinder/upload/files/wunaxaku.pdfIn PDF document text
- https://xlquality.com/userfiles/file/zujada.pdfIn PDF document text
- http://minipit.com/data/files/zunotugotur.pdfIn PDF document text
- https://xn--80adj7cxa.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/f5b74540b4835bccef6fe59beeea03da/purepanelapivof.pdfIn PDF document text
- http://falconfam.com/ckfinder/userfiles/files/sipazek.pdfIn PDF document text
- http://oprandi.it/userfiles/files/66896378232.pdfIn PDF document text
- https://keluargamimpi2.com/contents/files/nupewimitidigufijovewevuw.pdfIn PDF document text
- http://architectureanddesign.it/userfiles/files/gamoxixefo.pdfIn PDF document text
- http://www.benvenutialmare.com/wp-content/plugins/formcraft/file-upload/server/content/files/161a163cebe790---kuzevonoj.pdfIn PDF document text
- http://www.greenfield-sustainability.com/images/files/18456539936.pdfIn PDF document text
- https://wilgekrans.com/admin/user_files/files/51195976491.pdfIn PDF document text
- http://wayoflife.hu/userfiles/file/57964978262.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000394e3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x394E3 | 18312 bytes |
SHA-256: 18ccb33ef2b92c7e03b13b5cf2555b300f4609bb6c7dcf914d47e209953c7683 |
|||
font_01_sfnt_off0003c52d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3C52D | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_02_sfnt_off0003dc4d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3DC4D | 10804 bytes |
SHA-256: d0e795b2eb486d67e94f8a511e3627feed3b06cd499fc8e675befbe3d7fa0e28 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.