MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It functions as a link farm, directing users to numerous external websites, many of which are hosted on compromised CMS platforms. The presence of multiple PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics indicates a deliberate attempt to obscure the true malicious destinations by using a large number of disposable or compromised domains.
Machine Learning
- Nyx PDF Classifier malicious score 0.9922
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://southwestlooms.com/admin/userfiles/files/botijuzakorajarifutub.pdf
- https://www.medipratik.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ce5aefc2d9c---30730788915.pdf
- https://growlocals.com/wp-content/plugins/super-forms/uploads/php/files/a7da5e3d32649b024b99aa8e5766f692/munixojininoz.pdf
- https://goactive.hu/wp-content/plugins/super-forms/uploads/php/files/ad4e30fe9cc51adc40b20e096fca55f1/49963758663.pdf
- https://burstallconrad.com/editor_files/file/femaxilikituvixafuz.pdf
- http://anonelectronics.com/admin/fckeditor/editor/filemanager/connectors/php/upload_jpg/file/202106280331582762.pdf
- https://www.booster-p.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609251bd7ca32---64645591027.pdf
- https://kocarbon.vn/luutru/files/vubejupenaxoragid.pdf
- http://deauville.ru/files/file/ridubesalisiwadigogo.pdf
- http://longthinhphat.net/uploads/files/dinev.pdf
- http://bienbao.net/uploads/files/favarimo.pdf
- https://aprilboya.com/userfiles/file/84054573630.pdf
- http://muszempilla.com/files/file/rulefebawalubapifikel.pdf
- https://graffitipaintstudio.com/wp-content/plugins/super-forms/uploads/php/files/b11f52def409b7d9420091a2b5d3deed/tolepolibodemedoto.pdf
- https://law.com.sg/wp-content/plugins/super-forms/uploads/php/files/047a65a6a9dcd6fae09553f50c5147f7/63017889809.pdf
- http://www.canadiantreasurer.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d7e0ece0c7---90948527075.pdf
- http://altinay-law.com/images/file/nafavi.pdf
- https://prtl.pl/userfiles/file/kujiwufizuwikadusigesepal.pdf
- http://xn--e1aazeoc7d.xn--p1ai/images/shared/file/jizupenipuvobixedalamig.pdf
- https://www.potterycommercials.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160b98b2c44442---52635979445.pdf
- https://alkhairi.co.uk/wp-content/plugins/super-forms/uploads/php/files/09b3e886610e7aa0cbc4f3d05b9e90fa/93833449204.pdf
- http://www.canadiantreasurer.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a58b89914b0---vexexo.pdf
- https://www.urban-quartz.co.uk/wp-content/plugins/super-forms/uploads/php/files/2a71fa48743a7e43e45b90bc62eb3b8d/rudivitojujut.pdf
- http://hydrem.ru/images/file/vategojojimedorabuwepa.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=find+the+equation+of+the+curve
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d500.bin94da071d87cd7ee37ee961f4999d5c8ba7ea74871ed8c8102e48280920c52ce6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD500 | 1780 bytes |
font_01_sfnt_off0000dd63.bin3a9cb221d1c5a36ad6614f1f51bcdbedb2a5ea790f8f514fc31b52b5033ad3ff |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDD63 | 20416 bytes |
font_02_sfnt_off00011328.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11328 | 16792 bytes |
font_03_sfnt_off00012b3f.bin9611a2ab75a0734378f264431771d95cf4035fb9909e5ea5f238dedc90102939 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12B3F | 10648 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.