MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was flagged by ClamAV as a phishing trojan and by an ML classifier as malicious. It contains embedded JavaScript and numerous external URIs, many of which point to compromised WordPress upload directories or are part of a link farm hosted on disposable domains. The embedded JavaScript likely facilitates the redirection to these malicious sites, potentially for credential harvesting or further malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9955
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://ketchas.ru/uplcv?utm_term=nrca+roofing+manual+membrane+roof+systems
- http://lblussana.it/images/file/92939940964.pdf
- http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/baspb095ig8l85fj0ov0s5kul6/batidaruwuvupalebeka.pdf
- https://www.esfa.bg/root/ckfinder/userfiles/files/88104325547.pdf
- http://kdekdyjak.cz/data/80734990198.pdf
- http://azizavacanze.com/userfiles/files/98387370862.pdf
- http://www.julitolaschools.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e019801dbdf---67968868538.pdf
- http://sostrevalli.it/userfiles/files/3475445479.pdf
- http://madveras.com/ckfinder/userfiles/files/neziwewatewafisajud.pdf
- http://fashioncenterpoint.com/wp-content/plugins/super-forms/uploads/php/files/1269069e26774a7df6d653d1752175e4/5086816367.pdf
- https://marksiegeldds.com/wp-content/plugins/super-forms/uploads/php/files/ddcee016064bda10be02b98a12c1cd8f/12686323518.pdf
- http://barudan.hk/UploadFile/file/20210629004832468.pdf
- http://www.wallisandemmanuel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f455a1e019---rumemurowu.pdf
- https://www.sanier.pl/wp-content/plugins/super-forms/uploads/php/files/hvj1chau0jvr12ua7paq2ffejo/56215319543.pdf
- https://mujeresenmovimientoplus.com/userfiles/file/mesamimav.pdf
- http://www.gradur.ba/wp-content/plugins/formcraft/file-upload/server/content/files/161057db7e045f---83713668267.pdf
- https://www.kiteschule-kiel.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c1b9690b9f0---metexopakigowiz.pdf
- http://radiosalsa.fr/php/rs/filesupload/file/lenotipesobatobegeke.pdf
- https://skyfireconsulting.com/wp-content/plugins/super-forms/uploads/php/files/prs7am7davhm0luvo2m1nn8gj2/45152149565.pdf
- http://sanzmendia.com/userfiles/files/31863225333.pdf
- https://cor.org.ar/wp-content/plugins/super-forms/uploads/php/files/3jmsltb3rflv7tnqlnpfu6obtn/31164517641.pdf
- http://nassagroup.org/app/webroot/js/ckfinder/userfiles/files/geradubiganidusix.pdf
- https://khyatiinfotech.biz/ckfinder/userfiles/files/fepuxasu.pdf
- http://2m-m.eu/userfiles/files/67610908084.pdf
- https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ca01a908bd6---29027784300.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dd92.bin01da873f79be2f4ce07cd0b62b651abf10d3e11da758fd495c7ade175b503c6b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDD92 | 11008 bytes |
font_01_sfnt_off0000f73b.bin78e2263e188ab53d09258731eb4cb1b518d496b49b681deea504f60676f2b57e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF73B | 17876 bytes |
font_02_sfnt_off00012573.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12573 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.