MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous links to compromised CMS upload directories and disposable hosting, indicating a link farm designed to redirect users to malicious content. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a phishing or malware distribution intent. The ML classifier also flagged the PDF as malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.6906
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://epoxidice.ro/mm/file/40032029698.pdf In PDF document text
- https://msr-hudsonproperties.com/wp-content/plugins/super-forms/uploads/php/files/bcacc68a549bef66107e02df3d42cece/letifalowimaritusuxigu.pdfIn PDF document text
- http://cleannshieldflorida.com/wp-content/plugins/super-forms/uploads/php/files/fb748e21e874479714cd269ba81c36c5/deruxogabifiranajegewu.pdfIn PDF document text
- http://www.tenniscanberra.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160aa9471a8b14---11264801181.pdfIn PDF document text
- https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071a5bd04e49---rewukajumonabikewikot.pdfIn PDF document text
- http://dirabrealtors.com/wp-content/plugins/formcraft/file-upload/server/content/files/160713211b04cf---70448997791.pdfIn PDF document text
- https://beautyyaurient.com/editor_upload/file/7799721673.pdfIn PDF document text
- http://cricalliance.com/wp-content/plugins/formcraft/file-upload/server/content/files/16071b242ee51c---vedosexi.pdfIn PDF document text
- https://arizonapoolcontractor.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609032b6c4b04---niniponaxijapevamixu.pdfIn PDF document text
- http://sibinetweek.ru/userfiles/file/93418854937.pdfIn PDF document text
- http://www.theflightfest.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bc81036ac2b---sarowitaporoziwedidupad.pdfIn PDF document text
- https://atlasautoglass.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a32aaf3bc58---sapiniteduve.pdfIn PDF document text
- https://omomediacion.com/wp-content/plugins/super-forms/uploads/php/files/d7475e37da6087e97f36135d1ee96b71/82887112965.pdfIn PDF document text
- http://aiken7050.com/clients/5/51/510ae66c864a6d23552e02d1b5190e2c/File/vazegozopekip.pdfIn PDF document text
- https://sipsib.ru/wp-content/plugins/super-forms/uploads/php/files/e3bd6539a3deb6584c3017ddce03ed56/84979247180.pdfIn PDF document text
- http://youngshiny.com/userfiles/file/1621278078.pdfIn PDF document text
- https://mikepromedia.com/wp-content/plugins/super-forms/uploads/php/files/clifjcqvsn4tuk5en4bjl5qj84/mijusu.pdfIn PDF document text
- https://rajakeempat.com/contents//files/momasisopirigebikozepavig.pdfIn PDF document text
- http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/cfc61bb8c142d039e4b25151b617e7d7/kesanidiv.pdfIn PDF document text
- https://www.deuba.info/wp-content/plugins/super-forms/uploads/php/files/0u6hevjug4qftaqr6vjuu46phd/poluv.pdfIn PDF document text
- http://evpltravel.com/xv_image/file/13794201896.pdfIn PDF document text
- https://study-go.info/wp-content/plugins/super-forms/uploads/php/files/473d3d3df1702debf6360dc205bf5d3d/gakegaviluxejuvuba.pdfIn PDF document text
- http://aiswaryamatrimonials.com/fck_uploads/file/mususamatitibobogivikabov.pdfIn PDF document text
- https://panificiopasticceriabattaglia.it/file/21459329020.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=how+long+does+it+take+for+tea+to+go+badPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_003_off000109ea.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x109EA | 2437 bytes |
SHA-256: a0fba96d054065de5445b05a4f53515830b7cc046455fa2216b2eba5c5225dd2 |
|||
font_00_sfnt_off0000f1d9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1D9 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.