MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Heuristics identified it as a link farm, with multiple URLs pointing to compromised CMS upload directories and disposable hosting. These links likely serve as a lure to redirect users to phishing sites or download further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9987
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://emyorganizasyon.com/emy/ckfinder/userfiles/files/21778141691.pdf
- http://bobmeetin.com/media/galleries/files/67124230962.pdf
- https://stewsites.com/wp-content/plugins/super-forms/uploads/php/files/cf0e0702d8abaabed0ca457b6c176378/gexupefejagi.pdf
- https://wamsconference.com/wp-content/plugins/super-forms/uploads/php/files/9345b5ed14dc49a2a8c7afb817d3902f/89063065297.pdf
- https://florerialafloresta.com/ckfinder/userfiles/files/furokixegixuzupofajosalu.pdf
- http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/oj13enf0g7qi9ohbuk6a04jir6/8053471679.pdf
- https://www.gsccn.it/wp-content/plugins/formcraft/file-upload/server/content/files/160b817fe85e86---70079421779.pdf
- https://www.sabiamente.es/wp-content/plugins/formcraft/file-upload/server/content/files/1612ba7064a0c1---resixud.pdf
- https://www.charroninc.com/wp-content/plugins/super-forms/uploads/php/files/0ac5ed09148438c0fbd17e02c0ad2381/puvisikedapob.pdf
- https://weinquartier.at/wp-content/plugins/super-forms/uploads/php/files/de0cbd3e5d4da0145acb549c093396cc/mokon.pdf
- https://adbadog.com/wp-content/plugins/super-forms/uploads/php/files/2519769fcdc3d9aa0ddca8b817608544/nadujerudetukobeguri.pdf
- https://audreyheselmans.com/_files/file/zufos.pdf
- http://www.siphonicflowmandiri.com/upload/files/40265888318.pdf
- http://schmetterlingsgaerten.de/file/nizubedunuxodo.pdf
- http://anvlaw.com/userfiles/file/54749767631.pdf
- https://hinaweb.com/upload/file/dibolafofanuluxadev.pdf
- https://yourtuscanyguide.com/wp-content/plugins/super-forms/uploads/php/files/imeme4d02vaeas5solfs2bslc2/sobebunusamimak.pdf
- http://szakkepzosiklos.hu/upload/file/52684236173.pdf
- http://woonhuislift.info/wp-content/plugins/formcraft/file-upload/server/content/files/16087621173e05---34145750285.pdf
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c6176cf2de---rimubuvizoviva.pdf
- https://agsposure.org/wp-content/plugins/super-forms/uploads/php/files/27a66a49f3f2dbb6900949992535a76a/34211407089.pdf
- https://www.certificagreen.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f8d048e417c---vozutep.pdf
- http://magnachip.cn/userfiles/file/20210510174522.pdf
- http://naturabliskociebie.pl/userfiles/file/wesenije.pdf
- https://www.cpro.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160832d4321a2b---tizugejunuje.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/A3Ryygt5BCM/uplcv?utm_term=how+do+you+put+an+address+on+a+letter
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000daef.bin7c0a3648a95d9f0c58424b604b9add8444f48ff7f40da44aea7503cce2622b60 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDAEF | 16964 bytes |
font_01_sfnt_off0001067c.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1067C | 16792 bytes |
font_02_sfnt_off00011e93.bin2eed6f0776477ebdf23cd131a2c60b9a72ba3265bba6ce847f33cd645158c937 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11E93 | 10584 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.