MALICIOUS
172
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was flagged by ClamAV as a phishing trojan and by an ML classifier with high confidence. It contains an embedded JavaScript stream and numerous external URIs, many of which point to compromised WordPress upload directories, suggesting a link farm designed to redirect users to malicious content. The presence of embedded JavaScript indicates an attempt to execute code, likely to download and execute a second-stage payload.
Machine Learning
- Nyx PDF Classifier malicious score 0.9951
Heuristics 8
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.arphplumbing.co.uk/wp-content/plugins/super-forms/uploads/php/files/d6r7j00vc4tigqquanjplpfh9p/88007617788.pdf
- https://serka.com/serka/upload/files/55418924163.pdf
- https://amenagementsoleil.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099709b264be---99232805738.pdf
- https://elicopter-de-inchiriat.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160abe780d1589---bakixa.pdf
- https://ascinfratech.com/clientprojects/trading/file/9358583151.pdf
- http://gemwishrs.com/ckfinder/stones/files/repadosekovodirex.pdf
- https://refundsrefunds.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bd2a447d648---3152395879.pdf
- http://planbmedia.hufiles/wururekakidaluzeloranal.pdf
- https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087a2c67104d---pitixebiwitumezonewadi.pdf
- http://trackeg.com/en/wp-content/plugins/formcraft/file-upload/server/content/files/16084e16665b9e---84020770628.pdf
- http://www.mtpartnersfl.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609d50ad07899---toxexawasifoxubo.pdf
- http://tipkeo.com/js/ckfinder/userfiles/files/tapub.pdf
- http://meadescafe.com/userfiles/file/97178584353.pdf
- http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e94be783384---71711938314.pdf
- http://comicpapyrus.com/wp-content/plugins/super-forms/uploads/php/files/d57e1123d1312acef15f1092707d8001/vekawobosixozo.pdf
- http://cpils.com/userfiles/file/8845839209.pdf
- https://functionalmovement.gr/wp-content/plugins/super-forms/uploads/php/files/bfcdaec6bc914a6fd297d7276883f013/62774666663.pdf
- https://kuechentreff-schmid.de/wp-content/plugins/super-forms/uploads/php/files/pmufolrcqrhku8so5ovopme71q/gerugajamefekepi.pdf
- https://www.karenlovelee.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609492b42dfa9---7555080927.pdf
- http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/16077ade99fcef---76265093843.pdf
- http://sartor.ru/upload/files/79844253496.pdf
- http://stolizstekla.ru/userfiles/file/zeruwofemo.pdf
- http://budoprojekt.eu/obrazy/file/3802299853.pdf
- https://www.stamfordtaxis.com/wp-content/plugins/super-forms/uploads/php/files/emfoiqocn6qrl93l014oipc27j/22428768021.pdf
- http://szymonadamczyk.pl/uploads/fck/file/betadanenidafo.pdf
- https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=in+my+white+tee+song
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000edba.binf9c4e75dfeb1ab43607ddf9654d7c524237f70646d53ff54a19cae7bb92a5dcb |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDBA | 10400 bytes |
font_01_sfnt_off00010524.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10524 | 16792 bytes |
font_02_sfnt_off00011d36.bindd496e05c33a2a6e96d654d46e813c4841b6cc5091a1102215ab04c959f2212a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11D36 | 16676 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.