MALICIOUS
174
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file is identified as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure. It contains numerous external links, many hosted on compromised WordPress sites, suggesting an attempt to redirect users to malicious content. The PDF structure, with minimal text and a large image, is typical for a screenshot lure designed to obscure clickable elements.
Machine Learning
- Nyx PDF Classifier malicious score 0.5805
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 43 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://medvor.ru/uplcv?utm_term=calend%C3%A1rio+escolar+2018%2F19+pdf PDF link annotation
- http://www.empresasdelimpeza.info/wp-content/plugins/formcraft/file-upload/server/content/files/160bda293b1701---refilujepofuwumulibuneg.pdfIn PDF document text
- https://giriconsultancy.com/content_files/files/xopidifisewipozeninifexi.pdfIn PDF document text
- http://www.srijonihealinghome.com/fckimages/file/balukubugim.pdfIn PDF document text
- https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/41e220b435a97006a82711de286a8447/mazawibeligavuviluwas.pdfIn PDF document text
- http://emke.hu/uploads/ckfinder/userfiles/files/tosenejopumujo.pdfIn PDF document text
- https://mithermomix.com.mx/wp-content/plugins/super-forms/uploads/php/files/25107109a8c5ec8e3490004ea21fd5f3/jetovudezimuporagilamebo.pdfIn PDF document text
- https://famecosmica.it/file/tetasijokaginekozujigojex.pdfIn PDF document text
- https://pyhm.ca/wp-content/plugins/super-forms/uploads/php/files/jjiv0e5kn3sh80h6q5r68571l5/77593668115.pdfIn PDF document text
- http://bridgesonthepark.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c8fc06284bc---moxexexivolejanemenudes.pdfIn PDF document text
- http://ednak.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a52d2dbdb59---mivojonubawevewefevonuto.pdfIn PDF document text
- https://gpagroup.in/wp-content/plugins/formcraft/file-upload/server/content/files/160a7e96ca5dea---99290265559.pdfIn PDF document text
- http://www.hgbehringer.de/img/files/files/nijutagumitubexuguke.pdfIn PDF document text
- https://deesudcoolingtower.com/userfiles/file/zunetuzagerepufimij.pdfIn PDF document text
- https://luxmarketing.agency/wp-content/plugins/super-forms/uploads/php/files/g4vcddnk225tig4fu6br9gd2jt/86162526357.pdfIn PDF document text
- https://apparel.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/b964b3c21a409f64d9da5ace4dce7872/18404553123.pdfIn PDF document text
- https://netwindowvn.com/uploads/userfiles/file/vifimowume.pdfIn PDF document text
- https://dispomydeal.com/wp-content/plugins/super-forms/uploads/php/files/ab31e427daded11fa2c6985c4735c5a7/kikenu.pdfIn PDF document text
- https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/53b88d7ca04f3a0bf5047cbe949e8833/19773698240.pdfIn PDF document text
- https://pergamine.com/ckfinder/userfiles/files/55748139392.pdfIn PDF document text
- http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607037c119d9a---54583072559.pdfIn PDF document text
- http://www.sbawerribee.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608a76a1257ab---rukopogelaxinovowu.pdfIn PDF document text
- http://www.sunarozlem.com.tr/wp-content/plugins/super-forms/uploads/php/files/1aee2bgou4umo514av6o82grd1/vovuvusaferigabovogep.pdfIn PDF document text
- https://idd.no/ckfinder/userfiles/files/meduxigibumafaragokefofiv.pdfIn PDF document text
- http://ingenermarket.ru/userfiles/wituritalumilepanuxopom.pdfIn PDF document text
- https://www.sadcmedia.com/wp-content/plugins/super-forms/uploads/php/files/54j3dg9kjgohn3dpn1d71qogot/76080050520.pdfIn PDF document text
- http://www.expertnutritionadvisor.com/wp-content/plugins/formcraft/file-upload/server/content/files/16072e14de0100---jajonabojarerunupuguwunos.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.