MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains embedded JavaScript and numerous external URIs, many of which point to compromised WordPress sites acting as a link farm. ClamAV detected this file as Pdf.Phishing.Trojan, indicating a malicious intent to redirect users to potentially harmful content. The embedded JavaScript likely facilitates the redirection or further exploitation.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4578
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://endustriyelkiralama.com/wp-content/plugins/super-forms/uploads/php/files/bbpmfn9biif38tnchqn3s17rut/vuwofedob.pdf In PDF document text
- http://gt-outillages.fr/ressource/site-image/files/duwetuwarub.pdfIn PDF document text
- http://www.argentum.com/wp-content/plugins/super-forms/uploads/php/files/9k6ejm7pv204ukef83ncktdlkv/pebigofovore.pdfIn PDF document text
- http://maychaybocaocap.com/app/webroot/uploads/files/70745171914.pdfIn PDF document text
- https://estidevelopers.com/wp-content/plugins/super-forms/uploads/php/files/fb5b6bfa06bf7466f8730a9a03595106/63672454768.pdfIn PDF document text
- http://xn--939a66v0zjo3bcvdmrp.com/data/ckfinder/files/sepat.pdfIn PDF document text
- http://www.nuricomuvakfi.org/wp-content/plugins/super-forms/uploads/php/files/32lbf7tn6o93mja3i352rjt9d0/mezufaduvaxabaj.pdfIn PDF document text
- http://vin-baietii.ro/ckfinder/userfiles/files/55380986231.pdfIn PDF document text
- https://imahima.xyz/js/ckfinder/userfiles/files/mudesomusotibupexisixo.pdfIn PDF document text
- https://solarconsulting.org/wp-content/plugins/super-forms/uploads/php/files/aa4c00c38f3355075daa6be40c83e5b7/35121082651.pdfIn PDF document text
- http://barrarioservicos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16080c45481285---39582049908.pdfIn PDF document text
- https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/a77749dabfa5c4c3de959f44b1278e8c/gelonoretopeb.pdfIn PDF document text
- http://consol.hu/images/uploadedimages/file/wavexokabapipirimelusoj.pdfIn PDF document text
- https://cananalimdar.com/wp-content/plugins/super-forms/uploads/php/files/guq53ka0isrvjeh7midhvitssu/38291249601.pdfIn PDF document text
- http://feach.ie/images/uploads/file/pafoxutumewomad.pdfIn PDF document text
- https://medicinasolidale.org/wp-content/plugins/super-forms/uploads/php/files/f8a8060046c9cf681737ceb0cdc78325/84080875947.pdfIn PDF document text
- http://wahibluedevils76.com/clients/5/55/55d7338a7abcce318bc847d7f34994f5/File/namasaferopa.pdfIn PDF document text
- https://estigotours.com/wp-content/plugins/super-forms/uploads/php/files/2a1286cc9ce647764990ef7c2c54e3e2/jixifujagodakolesonod.pdfIn PDF document text
- http://www.radanhorse.com/resource/files/jatefuvomibadaxagubodu.pdfIn PDF document text
- http://educasters.co/ckfinder/userfiles/files/57365462298.pdfIn PDF document text
- http://c2mag.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e04ecf1a44e---vemaxa.pdfIn PDF document text
- http://compie.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160775be6e2d06---99660781912.pdfIn PDF document text
- http://areawifi.com/DESARROLLO/userfiles/files/92888675491.pdfIn PDF document text
- https://danielstrehlau.com/userfiles/file/16137023096.pdfIn PDF document text
- https://bellevuecommunityfoodbank.org/wp-content/plugins/super-forms/uploads/php/files/d084bf209201b4a909c17bdc1617cacf/76764275718.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=how+to+imprint+faster+arkPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e707.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE707 | 10644 bytes |
SHA-256: 385e5d7af23f4b38033dc285c9eb1233755874bbdb453a134477c6e7dc2ef26f |
|||
font_01_sfnt_off0000ff6d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF6D | 17336 bytes |
SHA-256: d5b06ad00ee79deda5717e720c6a809f3d771a3915809d708d8146e8fad539f3 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.