MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file is identified as malicious by ML classifiers and ClamAV, exhibiting characteristics of an advance-fee scam. It contains numerous links, many pointing to compromised WordPress sites, designed to lure victims into a fraudulent scheme involving lottery winnings or funds delivery. The document body is heavily obfuscated, preventing a detailed analysis of its specific content, but the heuristics strongly indicate a phishing or scam attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9820
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160866f24d2a1a---29278208956.pdf
- http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac303d2291d---70119910938.pdf
- http://www.hydro-tg.pro/upload/file/penedasikinisi.pdf
- https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077408a8a0d3---92295548384.pdf
- https://www.tanyadantus.com/wp-content/plugins/super-forms/uploads/php/files/bc987d0aef367fc5330e4b046c86abd5/71220467543.pdf
- https://kfz-gutachter-oliver-schiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/160bb528a1e15b---jonapuvidimite.pdf
- https://gservicepz.com/wp-content/plugins/super-forms/uploads/php/files/23c9eb03fe8b236d89ab85364d3922ed/83383119956.pdf
- https://gtsonline.nl/wp-content/plugins/super-forms/uploads/php/files/ustsspo84p2si91657sp5046u9/52012961852.pdf
- http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16080c7ee4ddf3---somilugegapejatanativezaw.pdf
- https://area5srl.it/file/nulukexow.pdf
- http://schs1968.com/clients/861610/File/taxobelagulozubew.pdf
- https://transit-connection.com/userfiles/files/dukegowululezutoxapuv.pdf
- http://zadonskiy.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16081700680a3a---nogedojozi.pdf
- http://uyaviation.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b9c207ec3ac---75629302089.pdf
- http://3dsami.org/uploadfilefiles/pisuvibix.pdf
- http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/411888ca9a773c75a8f9845924aa8c6f/48964688257.pdf
- http://hieuchuan.com/upload/files/noxomutezutabexuwela.pdf
- http://sl-light.ru/design/img/upload/file/17212383195.pdf
- https://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/53e2d8414eadb96261f2de4b7e1bcea5/bedesutilibako.pdf
- http://computergramm.com/userfiles/file/gotonitenuzade.pdf
- http://puzynowska-kancelaria.com/userfiles/file/suxipetoduwonatajap.pdf
- http://investin-khj.ir/ckfinder/userfiles/files/80118899307.pdf
- http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/1607bad6b3aea0---57359797848.pdf
- https://xn--78-6kce7dfhb9dwb.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/3cbe6e8d1384f456881d33366b2b7dde/kulemubudu.pdf
- https://givemeit.ru/wp-content/plugins/super-forms/uploads/php/files/20e02c2bfabb466b263800b3ecda923b/bilede.pdf
- http://jtour.vn/userfiles/file/niwebo.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=whining+meaning+in+tamil
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000115ac.bin0fdbd63b4994d3495a4045dde7221cf937204b7e867c921a4c57c7b2a9ba5391 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x115AC | 19480 bytes |
font_01_sfnt_off0001499a.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1499A | 16792 bytes |
font_02_sfnt_off000161b1.binbdcee7228dab95a65611b6e1280b34658b25f00b50db237ee25137d54b7fafa0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x161B1 | 10160 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.