MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF document contains numerous links pointing to compromised WordPress upload directories and SEO redirectors. The primary purpose appears to be a phishing lure or malware distribution, leveraging a link farm to obscure the final malicious destination. The ClamAV detection and ML classifier further support its malicious nature.
Machine Learning
- Nyx PDF Classifier malicious score 0.8256
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://cleannshieldflorida.com/wp-content/plugins/super-forms/uploads/php/files/ff7880dc5e18c3c80fbe398185049df4/43377171694.pdf In PDF document text
- http://xn--dlek-5qa.com/admin/UserFiles/file/gojel.pdfIn PDF document text
- http://allamericannursing.com/userfiles/file/30565681273.pdfIn PDF document text
- https://ludifrance.fr/userfiles/file/23446500568.pdfIn PDF document text
- https://www.fecomerciomg.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160d74c8b2ae56---27165712038.pdfIn PDF document text
- https://digireg.org/upload/rizupokilidoxibebigufo.pdfIn PDF document text
- https://eclipsetheaters.com/wp-content/plugins/formcraft/file-upload/server/content/files/160860e0358cd2---57820415690.pdfIn PDF document text
- http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/260f2abed9230c1b62a177f23495a4df/69280568185.pdfIn PDF document text
- https://cashmeredreams.com/wp-content/plugins/super-forms/uploads/php/files/333ad2e95a75f16baac7221b1a735fad/94519912563.pdfIn PDF document text
- https://jaunimodienos.lt/wp-content/plugins/super-forms/uploads/php/files/cmf0c6lkoh6h5e5aklr0hbj1ia/jegidiwoxerul.pdfIn PDF document text
- http://aj-logistics.com/stock/userfiles/file/zekunapalisokesosunili.pdfIn PDF document text
- http://call.ae/wp-content/plugins/formcraft/file-upload/server/content/files/16080b9edeeebf---66345764679.pdfIn PDF document text
- http://cargo3030.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16071bafa3d313---lasowuk.pdfIn PDF document text
- https://lashmakerpro.it/wp-content/plugins/super-forms/uploads/php/files/gj3c22gkivbc0f4sl6ncmib6t3/zeregezeb.pdfIn PDF document text
- https://drainscovers.com/wp-content/plugins/super-forms/uploads/php/files/05fefd7bf7d17e6f896fa1f869d34484/71526580130.pdfIn PDF document text
- http://www.idenet.net/wp-content/plugins/formcraft/file-upload/server/content/files/16095a1ff661c0---sowaw.pdfIn PDF document text
- http://www.petersmetalstitching.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160c5cfabac541---faxozawuremabigolad.pdfIn PDF document text
- http://edanieltour.com/FileData/ckfinder/files/20210625_35DBC1153DE69EB8.pdfIn PDF document text
- http://faurerom.com/userfiles/file/tenozuxetebavawupexej.pdfIn PDF document text
- https://palezieux.com/ckfinder/userfiles/files/tawuzumoxadozevikoz.pdfIn PDF document text
- http://asea-admin.com/_userfiles/file/20210523084516.pdfIn PDF document text
- https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ea3634fc75---38800308132.pdfIn PDF document text
- http://piau-po21inn.com/CKEdit/upload/files/fiwosuwefuzajilejigezuwi.pdfIn PDF document text
- http://www.asap-recruitment.net/upload/file/maluven.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=testing+types+in+software+engineering+pdfPDF link annotation
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00058634.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00058634.bin)
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00058634.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x58634 | 10788 bytes |
SHA-256: ecec5723e21a4be849afd695f9d90c113190e9de3d6225ab05975fa645e3240f |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.