MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was detected as malicious by ClamAV, indicating it is likely a phishing or trojan delivery mechanism. It contains numerous embedded URLs pointing to compromised WordPress upload directories and other disposable hosting, suggesting a link farm designed to redirect users to malicious sites. The file's structure and embedded content are consistent with a phishing lure or a downloader for a second-stage payload.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4237
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://philabc.ru/uplcv?utm_term=las+venas+abiertas+de+am%C3%A9rica+latina+resumen+cap%C3%ADtulo+4 PDF link annotation
- https://www.alertgy.com/wp-content/plugins/super-forms/uploads/php/files/fdc2a14fdeb27494079de73c820124ce/ragunugagutenipafexuj.pdfIn PDF document text
- https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/1cikrt3em6seomtgd9c4hnqf1t/rafolifexubin.pdfIn PDF document text
- https://dezsredstvompx.ru/wp-content/plugins/super-forms/uploads/php/files/5befacc0f80a516ea1607d72dbcd6849/wopeborinofuf.pdfIn PDF document text
- https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/fd43fb100cf614f0e3699f11a6044526/16326660872.pdfIn PDF document text
- http://xn--80akij1ajew.xn--p1ai/wp-content/plugins/formcraft/file-upload/server/content/files/1609f545c34ca8---31457933391.pdfIn PDF document text
- http://tinhdaurosa.com/Images_upload/files/5533632635.pdfIn PDF document text
- http://nigerseedindia.com/uploads/10913285541.pdfIn PDF document text
- http://info56.ru/userfiles/file/54224551966.pdfIn PDF document text
- http://modnyi-buket.ru/uploads/files/kipadiluxun.pdfIn PDF document text
- https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/ad7b0f92c944d3316d5d15343931b3cd/36556112024.pdfIn PDF document text
- https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160bd861392c79---51300028981.pdfIn PDF document text
- http://bulk-supplies.com/userfiles/file/kasubegogabatuzo.pdfIn PDF document text
- http://northwestpixie-bobs.com/clients/e/e1/e1941a3904c49320334fd90e0ed9e852/File/37019250119.pdfIn PDF document text
- http://stagnesreunion.com/clients/e/ed/ed16748122b3ff8ec97113314e0446c4/File/zoxosabiwe.pdfIn PDF document text
- https://joepromenshealth.com/wp-content/plugins/super-forms/uploads/php/files/6def4ba230e719d6aa538e57cb5d3a89/39261145554.pdfIn PDF document text
- http://coming-c.com/userfiles/file/vesodoxinuboz.pdfIn PDF document text
- https://cvsc.co/userfiles/file/lenamoxopajowosu.pdfIn PDF document text
- http://www.argentum.com/wp-content/plugins/super-forms/uploads/php/files/b2sakp8s73j8h40mg46lohdsce/fumelorizu.pdfIn PDF document text
- https://landatur.com/files/galeria/files/dalemu.pdfIn PDF document text
- https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160aae21258fb2---doxomubiwakalito.pdfIn PDF document text
- https://g-ortho.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607928a74cd80---kidizubopaxopasot.pdfIn PDF document text
- http://www.first-classlogistics.com/image/upload/File/gisobowivinuta.pdfIn PDF document text
- https://abandassociates.com/ckfinder/userfiles/files/19879612392.pdfIn PDF document text
- http://www.argentum.com/wp-content/plugins/super-forms/uploads/php/files/t8iev15p2mvdcl6bgnob3dq8re/39271979099.pdfIn PDF document text
- https://chicagoportablexray.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607b09725e5c7---jigaduba.pdfIn PDF document text
- https://amzentransportationindustries.com/admin/imagetemp1/file/legidazisisogugivizurisag.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00013115.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13115 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00014927.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14927 | 17588 bytes |
SHA-256: 2cc66c8405b6e7e2e517fb7fbe2ee5f5123ce66912c787589efcede494935b49 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.