MALICIOUS
64
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains numerous embedded URLs, many of which point to compromised websites or disposable domains, indicating a link farm designed to lure users to potentially malicious sites. The heuristic firings suggest the document is intentionally structured as a link farm, possibly for phishing or malware distribution. No scripts were extracted from this sample, limiting the analysis of direct execution capabilities.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3510
Heuristics 4
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pixomot.ru/uplcv?utm_term=formation+windev+22+pdf PDF link annotation
- http://svsteinfurth.de/radsportfiles/file/21719920713.pdfIn PDF document text
- https://razdolle.by/wp-content/plugins/super-forms/uploads/php/files/u6fhlt9irk5ru89gq5290ho767/86922498873.pdfIn PDF document text
- https://www.kindspring.org/inc/ckfinder/userfiles/files/27153131510.pdfIn PDF document text
- http://vtdsbinhthuan.vn/public/uploads/userfiles/file/bixopelozopadir.pdfIn PDF document text
- http://duetsepolno.pl/userfiles/file/27685206574.pdfIn PDF document text
- https://trisyscom.com/userfiles/file/texaloxanifomulup.pdfIn PDF document text
- https://forssh.com/userfiles/file/2366089069.pdfIn PDF document text
- https://avenirpourtous.fr/wp-content/plugins/formcraft/file-upload/server/content/files/1607f1deb9538d---36768536152.pdfIn PDF document text
- https://www.analfissur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d879f3377f---26265390042.pdfIn PDF document text
- http://uniquecharacters.com/upload/files/paxanitozunoxep.pdfIn PDF document text
- http://hnspkjx.com/d/files/kixatemularomajotoka.pdfIn PDF document text
- http://abnicum.ru/files/file/60932248761.pdfIn PDF document text
- https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/a6a77cff2954ef70ee048f88c84aa833/xiwugunekagazemelikat.pdfIn PDF document text
- http://vendingchat.ru/uploads/ckfinder/files/jixejedibilukewowawujer.pdfIn PDF document text
- https://eletroluz-al.com/_IMG/img_internas/file/riwuwumelemezetovejujom.pdfIn PDF document text
- http://dangkyidol.com/wp-content/plugins/super-forms/uploads/php/files/3bcq1uevppr1q56fa4k8an7qoa/duxazokurigibute.pdfIn PDF document text
- https://globalcircle.club/userfiles/file/48031311227.pdfIn PDF document text
- https://canionglobal.com/FCKeditor/file/92988574080.pdfIn PDF document text
- http://soeurs-scjboran.fr/soeurs/upload/files/minulofowisemefoxafepuru.pdfIn PDF document text
- http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16132e12f2ba40---jitateleminevafopomesowe.pdfIn PDF document text
- http://candybeauty.vn/upload/files/xilejapi.pdfIn PDF document text
- http://perfectthesale.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb099fa776f---90912516501.pdfIn PDF document text
- http://ontheedgeofnow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087fc919bd84---3740668386.pdfIn PDF document text
- http://veterky.ru/ckfinder/userfiles/files/59671007251.pdfIn PDF document text
- http://hotelclinton.it/userfiles/files/zaguro.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d74a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD74A | 22508 bytes |
SHA-256: 4748f5d4d7071ce8fc3981cf8f31df6b516f07387bd69713f4d8e04e927626cf |
|||
font_01_sfnt_off000111d7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x111D7 | 1684 bytes |
SHA-256: 9c928bf144e3eec6b0e52ae2bba533670589b2228405e28e178bb89e049a64b1 |
|||
font_02_sfnt_off000119ce.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x119CE | 16388 bytes |
SHA-256: ccf72b37f4042dd64bb67a2e5e961e22b551b7a8a6449ae0c89ac042836f922b |
|||
font_03_sfnt_off00013061.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13061 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_04_sfnt_off00014878.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14878 | 10692 bytes |
SHA-256: a58d8de5eedefef7142477812fd681b455fdf936bf7a593cfed5e84f67cfb438 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.