MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm, many hosted on compromised CMS upload directories and uses an image-based lure. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.5805
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 43 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://synerhu.ru/uplcv?utm_term=independent+events+probability+venn+diagram PDF link annotation
- http://discoveryenglish.org/wp-content/plugins/formcraft/file-upload/server/content/files/1608c8f3f82883---vebanajafuxafez.pdfIn PDF document text
- https://www.enterpriselighting.com/wp-content/plugins/super-forms/uploads/php/files/f354424a798e4314635b4a379c395c45/fasukowuzokikivones.pdfIn PDF document text
- https://www.sblending.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160bbb4b51ba2c---55462719940.pdfIn PDF document text
- http://krindustria.com.br/site/wp-content/plugins/formcraft/file-upload/server/content/files/1609f5a407bc85---39403985713.pdfIn PDF document text
- http://france-ex.com/images/blog//file/vugezaroxuv.pdfIn PDF document text
- http://ncdesign.it/userfiles/files/godemukegakesukifu.pdfIn PDF document text
- https://dolaodong.com/userfiles/file/67271369651.pdfIn PDF document text
- http://adhdadvisory.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e863822bb2---97579509013.pdfIn PDF document text
- https://iominneapolis.com/wp-content/plugins/super-forms/uploads/php/files/3426029ca424ae6118c8dd7f38856f72/51208719736.pdfIn PDF document text
- http://whalesart.com/uploadfile/file///2021061804503944.pdfIn PDF document text
- http://mognational.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a810a4e4fce---nenepirelexoporaxonu.pdfIn PDF document text
- http://baugeraeteverleih.de/benutzerdateien/jejexazafigizetugu.pdfIn PDF document text
- http://uat.ideadunes.com/projects/ideadunes-portfolio-site/wp-content/plugins/formcraft/file-upload/server/content/files/16073069028934---32612380316.pdfIn PDF document text
- http://smartmedicaleg.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606faf2d75f0b---zixanaguf.pdfIn PDF document text
- http://birons.net/wp-content/plugins/super-forms/uploads/php/files/fa8a2b4660da7ee00f18889bb7e279c9/97185781156.pdfIn PDF document text
- https://lawpropertyconsultants.co.uk/wp-content/plugins/super-forms/uploads/php/files/vj74hjbikh1nmjltds5138093k/69657179900.pdfIn PDF document text
- http://www.sunargrup.com.tr/wp-content/plugins/super-forms/uploads/php/files/kria8ko7i7q76tmsn0cbbmqvs1/vudopa.pdfIn PDF document text
- http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070694e1c2e3---sepabamog.pdfIn PDF document text
- http://optimus.org.au/wp-content/plugins/formcraft/file-upload/server/content/files/160b747df320cf---xogujiganebipipukanazap.pdfIn PDF document text
- http://fortlauderdalelimorental.net/wp-content/plugins/formcraft/file-upload/server/content/files/16075441016757---lafiw.pdfIn PDF document text
- https://kindliving.org/wp-content/plugins/super-forms/uploads/php/files/tmp/35752485979.pdfIn PDF document text
- https://binarbaid.com/public_html/userfiles/file/nenuxusojeripi.pdfIn PDF document text
- http://alhouti.com/userfiles/file/xexiniruxevodu.pdfIn PDF document text
- http://montgomery71.com/clients/34132/File/somizuna.pdfIn PDF document text
- http://brodart01.com/wp-content/plugins/super-forms/uploads/php/files/443329sd2n04spf5o4n290p8dm/78353767124.pdfIn PDF document text
- https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d3da2e5663---sesoxipufevopav.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.