MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file was detected as a phishing trojan by ClamAV. Static analysis revealed it functions as a link farm, presenting numerous URLs hosted on potentially compromised or disposable domains. These links are likely intended to redirect users to phishing sites or download further malicious content.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4578
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://inwebjor.ru/uplcv?utm_term=theory+of+dislocations+pdf PDF link annotation
- http://washchienluoc.com/upload/file/wadegitasevowin.pdfIn PDF document text
- http://elementsgogreen.com/userfiles/file/62343408762.pdfIn PDF document text
- https://www.chesapeake-lighting.com/wp-content/plugins/super-forms/uploads/php/files/f2183fa4a9493ac29f5d484b96f8a7bc/zopifutumowakapifetot.pdfIn PDF document text
- http://xperion.hu/wp-content/plugins/super-forms/uploads/php/files/29c3d40ff91b4f0061828dedf25ae87a/zupapuzodakokak.pdfIn PDF document text
- http://auburn-properties.com/userfiles/files/3299298974.pdfIn PDF document text
- https://alarrabnews.com/images/content/content/file/xekom.pdfIn PDF document text
- https://koetec.com/home/~ptow/public_html/ckfinder/userfiles/files/26467259512.pdfIn PDF document text
- https://teplitsyoptom.ru/wp-content/plugins/super-forms/uploads/php/files/c20b0aab4a357991cdff0ae6c2d850da/nomikesiwepiw.pdfIn PDF document text
- http://multi-accueil.fr/ressource/site-image/files/junadababuxanilufovux.pdfIn PDF document text
- http://martonaroniskola.net/userfiles/file/moresumujenibi.pdfIn PDF document text
- http://ekolojikweb.net/upld/userfiles/file/vitomopafi.pdfIn PDF document text
- https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/oibqhv01r0e4d4e2r2hk9jd0e1/20130708143.pdfIn PDF document text
- https://beribuket.ru/wp-content/plugins/super-forms/uploads/php/files/b786f934d9980c1de800e999169c5f83/32001747879.pdfIn PDF document text
- https://strategieb2b.com/userfiles/file/27085639538.pdfIn PDF document text
- http://iwish-cosmetics.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a497e58a3dc---soguzogezemon.pdfIn PDF document text
- https://www.corridar.com/wp-content/plugins/super-forms/uploads/php/files/mapbn10q94d8tr3lhhft616ku6/23382958452.pdfIn PDF document text
- https://cristalensi.com/public/File/salajoxerepaxas.pdfIn PDF document text
- https://www.rockandroll.blog.br/wp-content/plugins/super-forms/uploads/php/files/v0ues2309cfh5aa88mto05jpaq/bunud.pdfIn PDF document text
- http://www.danvillern.com/wp-content/plugins/super-forms/uploads/php/files/ummm58aj57l5bl7519r1j7mgg2/36142248615.pdfIn PDF document text
- https://webhostmurah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160803c08058b1---41855373050.pdfIn PDF document text
- https://sgdivorcelawyers.com/wp-content/plugins/super-forms/uploads/php/files/af82720e6d50c19f912ec79fb8cb1872/21181533188.pdfIn PDF document text
- http://ecole.ru/text/images/file/pifodutanezasomutazu.pdfIn PDF document text
- https://nam.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607062c418284---69415458019.pdfIn PDF document text
- http://arenda-v-novosibirske.ru/ckfinder/userfiles/files/luvamupufixax.pdfIn PDF document text
- https://pmms-online.com/assets/file/mebusiwexegakevu.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e5a3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE5A3 | 18076 bytes |
SHA-256: c24370fc9126e4eaa148e333a38cd736b20b78f999db959d43922c060edaad2f |
|||
font_01_sfnt_off0001154e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1154E | 10796 bytes |
SHA-256: 0c739883ca5c8bdadb12aef1c38070800b903391c6a791f3fed9b69683c66c4b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.