MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The sample is identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous embedded URLs pointing to compromised WordPress sites and other disposable hosting. These links likely lead to phishing pages or further malware downloads, consistent with a spearphishing attachment attack vector.
Machine Learning
- Nyx PDF Classifier malicious score 0.8097
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://crysiq.ru/uplcv?utm_term=can+i+get+minecraft+windows+10+for+free+if+i+have+pocket+edition PDF link annotation
- http://ceraunavoltapizzeria.it/userfiles/files/xegidufexabiwuxewuwososik.pdfIn PDF document text
- https://propbrains.com/wp-content/plugins/super-forms/uploads/php/files/3qpgdvjskf92v0dbttqd00iip6/rapubirovadujopu.pdfIn PDF document text
- https://cms.blauraum.com/wp-content/plugins/super-forms/uploads/php/files/38092edf7a44def937f7dd8159867c2b/posatekegirewafak.pdfIn PDF document text
- https://legacyltg.com/wp-content/plugins/super-forms/uploads/php/files/7e4d96cbb307c000f694e9e4af8a7b63/98970308441.pdfIn PDF document text
- https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160d18a7bb5494---lifudeloko.pdfIn PDF document text
- http://mientaytourist.com/uploads/files/fasemoki.pdfIn PDF document text
- http://duonglaohanoi.com/userfiles/file/lajabo.pdfIn PDF document text
- https://www.guestquesttravelmedia.com/wp-content/plugins/super-forms/uploads/php/files/29lllri29m0i8inmkc3kqsmtsb/79908822852.pdfIn PDF document text
- https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/40ee0e1a5328bdfbfc5b096a9d0327d9/19280724269.pdfIn PDF document text
- http://carrollcountylawyers.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/zipopobunegituniduzilodu.pdfIn PDF document text
- http://www.peretprod.ro/content-images/file/76772125893.pdfIn PDF document text
- http://firewheels.pe/userfiles/file/rolefibowebegomotinifor.pdfIn PDF document text
- https://awlights.com/wp-content/plugins/super-forms/uploads/php/files/f8167d4611f7de5daf9f23b5bfe4240c/6923314869.pdfIn PDF document text
- http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/160b1cb8707137---tawanasapozu.pdfIn PDF document text
- http://carlaschroyen.com/content_docs/nusumamovotudaw.pdfIn PDF document text
- http://hockeydh.com/files/ups/files/matafukanisemame.pdfIn PDF document text
- https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/16076606213310---69020319093.pdfIn PDF document text
- https://hsegroup.ru/wp-content/plugins/super-forms/uploads/php/files/ppacg911nj3ttrm464e7av3j46/34315042260.pdfIn PDF document text
- http://worksafeorg.com/wp-content/plugins/super-forms/uploads/php/files/68749nrdemtgqhge02qadeku62/kezefufawufoxebamelubi.pdfIn PDF document text
- https://www.ogblfrontaliers.fr/wp-content/plugins/super-forms/uploads/php/files/ef1drucaa9s5t0gbeb0tkr32dr/viposefiposurimezemipi.pdfIn PDF document text
- http://hoteldazegliotorino.com/userfiles/files/46045681706.pdfIn PDF document text
- http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bda98b1da0c---52661653329.pdfIn PDF document text
- https://esteticarcare.com/wp-content/plugins/super-forms/uploads/php/files/6ab306fa299bb3ef09a4ec35e06eb4e1/lupagimizisikel.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ef62.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF62 | 18068 bytes |
SHA-256: 912770a55afbe0222c69a7468fb44705f5cdb5d2f4bd4fcb2adbf8e085cec188 |
|||
font_01_sfnt_off00011d8b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11D8B | 11468 bytes |
SHA-256: e13782592d618f77a3c3bc684ea89bc9d1b424321ec8180f3810a88964017ae5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.