MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF file contains numerous external URIs and links to compromised CMS uploads, indicating it functions as a link farm. These links likely lead to phishing pages or further malware downloads. The ClamAV detection and ML classifier strongly suggest malicious intent, classifying it as a phishing trojan.
Machine Learning
- Nyx PDF Classifier malicious score 0.8605
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://inwebjor.ru/uplcv?utm_term=what+is+mild+aspergers+symptoms PDF link annotation
- https://www.clubmanizales.com.co/wp-content/plugins/formcraft/file-upload/server/content/files/1607b4c3ad6221---6491911183.pdfIn PDF document text
- https://gpagroup.in/wp-content/plugins/formcraft/file-upload/server/content/files/160c87c72d8810---80714560811.pdfIn PDF document text
- http://szkolka-wiercioch.pl/files/file/wenufegojidazid.pdfIn PDF document text
- https://agrachoff.ru/wp-content/plugins/super-forms/uploads/php/files/75c629dd51c7309b6ff33bdd01d384db/97282421537.pdfIn PDF document text
- https://sketchup360.vn/wp-content/plugins/super-forms/uploads/php/files/3dgh81pbvp2f6240nl4liakvcb/gakapef.pdfIn PDF document text
- https://regalcabs.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160db7bd31d62c---91014191843.pdfIn PDF document text
- https://evocative.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160834e7da235a---xusotujejagozukiw.pdfIn PDF document text
- http://antwerp-rentals.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aaba4053f19---gibudefufoveru.pdfIn PDF document text
- https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160876fa23df86---82795458464.pdfIn PDF document text
- https://mamproducciones.es/wp-content/plugins/formcraft/file-upload/server/content/files/160abd0f8d3c26---78223553226.pdfIn PDF document text
- http://aceonlinementors.com/userfiles/file/tixugopixumugepewum.pdfIn PDF document text
- http://www.iamgoingto1996.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608947b07cf56---50697551892.pdfIn PDF document text
- http://sklepjola.pl/userfiles/file/rulawusajepojabanokasol.pdfIn PDF document text
- https://thefertilizerequipment.com/d/files/kupagoraliz.pdfIn PDF document text
- http://evabody.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b9c8c2aa50f---rirugenalupofatiwubonofad.pdfIn PDF document text
- http://golden-candies.ru/webroot/files/files/lexatuxojanimefuruk.pdfIn PDF document text
- http://otvorene-srdce.sk/userfiles/file/ferowojigigarufotized.pdfIn PDF document text
- http://pytextiles.com/userfiles/file/dudibon.pdfIn PDF document text
- https://www.rockandroll.blog.br/wp-content/plugins/super-forms/uploads/php/files/et5bo1rbe2cce8iku3qo6oallv/wuvomokuxofexivujej.pdfIn PDF document text
- https://www.beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/bd461d8c8a50eac9b28ad36253ea6658/64013921975.pdfIn PDF document text
- https://www.hemoroidklinigi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073a76195199---rofizaselat.pdfIn PDF document text
- http://greatnice.club/updatefiles/file/10923382649.pdfIn PDF document text
- http://sinara.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c27e55644a7---22915217923.pdfIn PDF document text
- https://joyfool.art/wp-content/plugins/super-forms/uploads/php/files/45f4e043430d50aed05f54f1cccfab6a/814485510.pdfIn PDF document text
- https://arch.ua/ckfinder/userfiles/files/gujomugonofu.pdfIn PDF document text
- http://maxitelt.no/wp-content/plugins/formcraft/file-upload/server/content/files/160778366f3538---9194536976.pdfIn PDF document text
- https://www.alphaveneers.com/wp-content/plugins/super-forms/uploads/php/files/0b87877bb81442d798c4ebea921b1b00/11629762985.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fe42.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE42 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.