MALICIOUS
236
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
T1059.007 JavaScript
The PDF document was flagged by ML classifiers and ClamAV as malicious, exhibiting characteristics of a phishing and trojan delivery mechanism. It contains a lure for remote-support tools, suggesting an attempt to gain unauthorized access to a user's system. The presence of numerous links to compromised WordPress sites indicates a broad distribution effort, likely to host or redirect to malicious payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9978
Heuristics 8
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMANDExtracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
-
Remote-support tool lure high SE_REMOTE_SUPPORT_LUREDocument instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.areatransfers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1c119a9714---13049789582.pdf
- https://www.advids.io/wp-content/plugins/formcraft/file-upload/server/content/files/1609c64975bf43---purozujuxoso.pdf
- https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16078008716696---83829284152.pdf
- https://www.amiunaorchestra.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1607716d27aaa3---11882050158.pdf
- https://k-kompany.ru/wp-content/plugins/super-forms/uploads/php/files/4c201760b7c7ca8f3ee2389c47e89bd8/57335411018.pdf
- https://law.com.sg/wp-content/plugins/super-forms/uploads/php/files/b79f458f8c2c828b41a93ad33ee3db58/79198701427.pdf
- https://lsp.od.ua/wp-content/plugins/super-forms/uploads/php/files/fmum8oog0ahibu1sk5hnlcmdj0/lefezovuwew.pdf
- https://afriqueitnews.com/wp-content/plugins/super-forms/uploads/php/files/56ca8f492ac0d840bb95900acb7ee057/2194369774.pdf
- http://sethhukumchandschool.com/userfiles/file/6682776428.pdf
- https://livstyle.ro/home/livstyle/public_html/uploads/files/gusix.pdf
- http://zap-interactive.com/uploads/files/mizepagofalezuwezum.pdf
- https://www.charityweiss.de/wp-content/plugins/formcraft/file-upload/server/content/files/1607499379eda1---79638153404.pdf
- http://currycornersugarland.com/admin/images/file/79038244834.pdf
- https://ercrs.org/wp-content/plugins/super-forms/uploads/php/files/ioe95cntog1lgqd5qpuuanngl0/51789173394.pdf
- https://archltginc.com/wp-content/plugins/super-forms/uploads/php/files/b78a12ca5b60e94a52ec051f7ec597ca/lobumifeta.pdf
- https://accuratesearch.com/userfiles/file/farivezegefazefubunuli.pdf
- https://angelsforwarriors.org/userfiles/files/12932065704.pdf
- http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160b991f03e472---61043759704.pdf
- https://asiarsolutions.com/userfiles/file/80187869233.pdf
- https://jamuiboe.com/webroot/upload_media/kidisebuzajun.pdf
- https://eandjfamilyhealthcenter.com/wp-content/plugins/super-forms/uploads/php/files/30110a8e0cd4b8eef115fa4226696aa8/gaserizuxajivitimedilebav.pdf
- http://standartbio.com/fckfiles/file/mefuvire.pdf
- http://europavloeren.nl/siteimages/file/3104610642.pdf
- http://dlmberatung.ch/userfiles/files/6486816233.pdf
- https://afriqueitnews.com/wp-content/p
- https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=panaderia+y+reposteria+para+profesionales
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d0ed.bin4cda737718289d406d3fb3d95325dad2326e00610ec4d4aac81d219cf12ecf41 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD0ED | 10608 bytes |
font_01_sfnt_off0000e944.bin38143ccc6f39d0753b52975fbc0aa009ff9c06d8588b1ee47a3c52dcc91f758d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE944 | 17728 bytes |
font_02_sfnt_off000116c2.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x116C2 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.