MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The sample was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links to external PDFs hosted on compromised websites, suggesting a link farm designed to distribute malware or phish for credentials. The presence of PDF-specific heuristics like 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' and 'PDF_SEO_DISPOSABLE_LINK_FARM' further supports this, pointing to a distribution mechanism that leverages compromised web infrastructure. No scripts were extracted, but the overall structure and heuristics suggest a phishing or malware delivery attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9964
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://prana.video/wp-content/plugins/super-forms/uploads/php/files/a2sbtb4bkbs7mnjv7u64b7kmvu/69378515946.pdf
- http://www.startservis.sk/novy/ckfinder/userfiles/files/31474816090.pdf
- https://www.ezhealthcheck.com/wp-content/plugins/super-forms/uploads/php/files/71c03ujrkp3k5bqdijllolf2vk/lefaterosevofupet.pdf
- https://fietenhaardenenkachels.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160abd8b04ee90---pedefulinazemuvivudoluv.pdf
- http://www.chinahkcarplate.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607f63c93b66b---86286954110.pdf
- https://controlcert.se/wp-content/plugins/formcraft/file-upload/server/content/files/1606d583316879---misike.pdf
- https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/c5b870d49942e8b80111e4bbf6b180ad/89390365650.pdf
- http://alvasari.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608db0ca64051---90059813485.pdf
- https://areshin.ru/wp-content/plugins/super-forms/uploads/php/files/40b28b9f2175a61df56ac251a047b9a5/3904794234.pdf
- http://morgancountyoh.com/userimages/vefubikijesekegovebixe.pdf
- http://kartinatv.org/uploads/files/98326106453.pdf
- https://www.lashharmony.co.uk/wp-content/plugins/super-forms/uploads/php/files/tiupq1ogq7dubhugi3lrpo9bri/89643905102.pdf
- https://thehamptonsbloomington.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609107f4de874---19167154792.pdf
- https://www.taxikladis.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160835918aa6aa---75994848050.pdf
- https://arizonalightingsales.com/wp-content/plugins/super-forms/uploads/php/files/4ffda4d5d1862107c90bd9c6470efe8d/98001037402.pdf
- https://www.straightmyteeth.com/wp-content/plugins/super-forms/uploads/php/files/ecae2856d4c6835a784e02a4b4bb6e76/98347228912.pdf
- https://discoverapartmentsforrent.com/wp-content/plugins/super-forms/uploads/php/files/2d55b73e125139b665c6aca0a64fc817/xajaxikogizakonepol.pdf
- http://kazenergy.kz/wp-content/plugins/formcraft/file-upload/server/content/files/160745e531743e---10072537194.pdf
- http://614move.com/clients/4890/File/7963702227.pdf
- https://dispomydeal.com/wp-content/plugins/super-forms/uploads/php/files/ac119c0ba1421873b121ff1502ac5fb8/latopibebaxum.pdf
- https://www.adilaltinsoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607580305b602---62390634861.pdf
- http://fantasymusic.it/userfiles/files/45537633617.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=introduction+to+computing+and+problem+solving+with+python+pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e7ac.bin0886085aec73f1d47feccf1f4f562d613127db9951b15d193e245987f84d2a5a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE7AC | 11524 bytes |
font_01_sfnt_off00010270.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10270 | 16792 bytes |
font_02_sfnt_off00011a82.binbc5617b491de7f89b726ccd2f7a15c88df6752323b8c174eb67ede7ac5c37207 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A82 | 16756 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.