MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The sample is a PDF document identified as malicious by ML classifiers and ClamAV. It functions as a link farm, containing numerous URLs pointing to compromised WordPress sites and other disposable hosting. These links likely lead to phishing pages or further malware downloads, indicating a spearphishing attachment vector. No scripts were extracted, but the PDF structure itself facilitates the redirection.
Machine Learning
- Nyx PDF Classifier malicious score 0.7561
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://huntic.ru/uplcv?utm_term=what+type+of+bond+holds+molecules+together PDF link annotation
- http://tomaszskiba.com/userfiles/file/13969907640.pdfIn PDF document text
- http://argentum.com/wp-content/plugins/super-forms/uploads/php/files/9aftsoufk2k70c9hu7q879e1l6/nazepofuwegilivu.pdfIn PDF document text
- https://advancedcheckcashadvance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160915c490345e---nusewalexufisaribuwuwula.pdfIn PDF document text
- http://haustechnik-hagenauer.at/dusuwajajatizagesijoka.pdfIn PDF document text
- http://soflacops.com/clients/83266/File/87045220908.pdfIn PDF document text
- http://capthepcongtrinh.com/uploads/news/files/3449475285.pdfIn PDF document text
- https://ropaalmayoreo.com/images/userfiles/file/tepoton.pdfIn PDF document text
- https://fieldofgreen.com/wp-content/plugins/super-forms/uploads/php/files/502446e79511f6255bc3a1397975ed7c/lijulekatirito.pdfIn PDF document text
- https://backcountryplayground.com/wp-content/plugins/super-forms/uploads/php/files/71e3d0f7134a9dca5e49777a0e6aa985/16527804853.pdfIn PDF document text
- https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608494d1847ee---75268558589.pdfIn PDF document text
- https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/53a3c88069eb37d7a04b471f99db914f/89712739069.pdfIn PDF document text
- https://uaqbakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612117f21d86c---26849687677.pdfIn PDF document text
- http://www.segurosfacility.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16071e1dd7229d---93948152430.pdfIn PDF document text
- http://jfe.hk/userfiles/38392616296.pdfIn PDF document text
- http://kompletucetnictvi.cz/files/file/42464532169.pdfIn PDF document text
- http://takeacode.net/user/d41d8cd98f00b204e9800998ecf8427e/file/95325003432.pdfIn PDF document text
- http://www.infranetltd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a0561b7da7a---xebikefixoratuvuvaxi.pdfIn PDF document text
- https://riverasphotovideo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16111edf167e8a---jerewopifuwufi.pdfIn PDF document text
- http://www.luminicaambiental.com/wp-content/plugins/formcraft/file-upload/server/content/files/16090b7754afc2---nuvamojakixit.pdfIn PDF document text
- http://endemic-capital.ru/uploads/files/wuzubesibiwegejaparur.pdfIn PDF document text
- https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/16096416ba7e42---49308122464.pdfIn PDF document text
- https://bushregenerators.com/userfiles/files/44619028256.pdfIn PDF document text
- https://textosl.com/upload/editor/file/vuwelexavavimomelef.pdfIn PDF document text
- http://nuyewpilot.academy/wp-content/plugins/super-forms/uploads/php/files/7c165b54d0a8c2f92dc5f101f4ae78e5/84156791846.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dff4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFF4 | 11320 bytes |
SHA-256: 0ebc9af35fd1c6f0e8566da308078584cf0b7cb43f2267bf6b56170fc1452a16 |
|||
font_01_sfnt_off0000fa09.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA09 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.