MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a link farm directing users to multiple distinct hosts, many of which appear to be compromised WordPress sites. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a malicious intent, likely to lure users to phishing pages or download further malware. The presence of numerous links on disposable hosting and the use of UTM parameters further indicate a campaign designed for obfuscation and distribution.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4578
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vinadesigndanang.vn/uploads/image/files/51719118367.pdf In PDF document text
- http://quickvideo.nl/userfiles/file/buronireginidivutedetu.pdfIn PDF document text
- http://henrycrawfordreunion.com/clients/1/19/1929e20d1ffebcad6d8b2a659e9c170d/File/52538263493.pdfIn PDF document text
- http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608645b6aae59---58152545380.pdfIn PDF document text
- https://churchosonline.com/wp-content/plugins/super-forms/uploads/php/files/6c0f46505c6688e2c1c1b190c9412515/sisolazobumugewivupas.pdfIn PDF document text
- https://www.northamericatalk.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e3498d7186---pugesotamavirupilig.pdfIn PDF document text
- https://www.hotel-palladium.gr/wp-content/plugins/super-forms/uploads/php/files/hd534vcfutn37k63qjplqvimsk/zivep.pdfIn PDF document text
- https://www.kunapak.com/wp-content/plugins/super-forms/uploads/php/files/a25l6j9nrb1ritj0d23gdvde15/55316753647.pdfIn PDF document text
- https://traveletrust.com/basefile/traveletrustcom/files/13587534417.pdfIn PDF document text
- https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6d952b8a83---jadidamupox.pdfIn PDF document text
- https://luxurytravel-show.com/wp-content/plugins/super-forms/uploads/php/files/b336ed206fa4c13e6aa367a635c93953/numonus.pdfIn PDF document text
- http://blbr365.com/userfiles/file/1620842667.pdfIn PDF document text
- https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/1625bb6a2ff3919fd72bd4f73fa28fe6/jinozimibuf.pdfIn PDF document text
- http://structurecreative.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9683351f6f---laxesisezudoli.pdfIn PDF document text
- http://toicodonlyson.com/uploads/files/bufefowizuti.pdfIn PDF document text
- https://www.hontoys.com.au/wp-content/plugins/super-forms/uploads/php/files/i0rp7ur7pp9um620o3tue3g966/lexod.pdfIn PDF document text
- http://lblussana.it/images/file/vuruneminokijejavilokijos.pdfIn PDF document text
- http://ahcxdq.com/uploads/file/051831396454.pdfIn PDF document text
- http://www.kevinbrooks.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1606eb8f7d71ad---wavipe.pdfIn PDF document text
- http://www.itbaloch.com/wp-content/plugins/formcraft/file-upload/server/content/files/160774cf6f22b6---34722282452.pdfIn PDF document text
- http://bobiniauto.com/userfiles/file/levekuvinofide.pdfIn PDF document text
- http://supermarketdv.ru/files/file/42737237718.pdfIn PDF document text
- https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/f0f3ea9258d2bdca09d97af5bff92c6e/demufijasikiworapad.pdfIn PDF document text
- https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160850e361d957---98522300562.pdfIn PDF document text
- http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2ad639313e---66937433733.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/FevRqgeaUVY/uplcv?utm_term=science+technology+and+society+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e48a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE48A | 16640 bytes |
SHA-256: 41dbeb6d1f63bd79fc6a51b2bd628c51bdc147ec868c432f677bd6804ca09d69 |
|||
font_01_sfnt_off00010fa0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10FA0 | 10988 bytes |
SHA-256: 9ea8dcfcad24cc06d507275f789036e2f788dea9eddfd5bdf85ac1153fb58af8 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.