MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 User Execution: Malicious File
The PDF was identified as malicious by ClamAV and an ML classifier. Static analysis revealed it functions as a link farm, with numerous URLs pointing to compromised WordPress sites. These links likely serve as a distribution point for phishing content or further malware, leveraging the 'Spearphishing Attachment' technique.
Machine Learning
- Nyx PDF Classifier malicious score 0.5046
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/i8bbs50nj7iamh5tlnvi0092sp/rerivazirimuv.pdf In PDF document text
- http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a769164636e---poniwiruxutu.pdfIn PDF document text
- http://wypelnienia.kratex.pl/wp-content/plugins/super-forms/uploads/php/files/959a898319cadd8f5d5c7a70b468a8aa/31664534637.pdfIn PDF document text
- http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160b901631ca7c---nawaredow.pdfIn PDF document text
- http://kraljicabih.com/wp-content/plugins/formcraft/file-upload/server/content/files/160925b775259e---dimukejapemit.pdfIn PDF document text
- http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607e75c721a7b---46919441876.pdfIn PDF document text
- https://benchmarktransitions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160730f159663d---vavopexiroturuluzuwusa.pdfIn PDF document text
- https://finestblogger.de/wp-content/plugins/super-forms/uploads/php/files/ulhuncaij9urdul0i94g29es7t/37141982791.pdfIn PDF document text
- http://magicdiscoradio.hu/userfiles/file/96198000231.pdfIn PDF document text
- http://sazjah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160846cb1f1e6b---16529707096.pdfIn PDF document text
- https://414movement.com/wp-content/plugins/super-forms/uploads/php/files/91f153d44f95b5235bab1e3a0500541b/tidurezuvasofiragif.pdfIn PDF document text
- https://www.sahabatkeluargahomecare.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077ecd4a6f01---duvixatabezolusuzikifif.pdfIn PDF document text
- http://aelma.com/sites/default/userfiles/file/wilixupazezufenewiriwug.pdfIn PDF document text
- http://drjoecarver.com/clients/49355/File/tejuvupuseburebeforo.pdfIn PDF document text
- https://sharzh-ufa.ru/wp-content/plugins/super-forms/uploads/php/files/584238044b2f57871341392f8d6511fc/rexafuxiwazitopaxofa.pdfIn PDF document text
- http://makinsushi.com/uploads/files/40324215592.pdfIn PDF document text
- https://businesslife.com/content/file/33152750591.pdfIn PDF document text
- http://enjoybowlramenandpoke.com/uploads/files/31296411617.pdfIn PDF document text
- https://landlorddebtadvisory.com/wp-content/plugins/super-forms/uploads/php/files/bg05e8s9bl4rube1kiugs4nlk1/52633230283.pdfIn PDF document text
- http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c133cd56879---zinifejivebesozujar.pdfIn PDF document text
- https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/5372ea1883f65febc99a014fb6f1a0aa/31265536992.pdfIn PDF document text
- https://genesisbehaviorcenter.com/wp-content/plugins/super-forms/uploads/php/files/ef6170c3991af5890ecb46a362ab221b/nakefikikozo.pdfIn PDF document text
- http://bielwod.com/userfiles/file/86658807989.pdfIn PDF document text
- http://nuyewrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/bb0f3efdf28d2c16a4f323ba10876210/wutinizunowigar.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/cv9VXjIrmdE/uplcv?utm_term=new+gem%27s+english+reader+class+6+solutionsPDF link annotation
Open this report in the interactive analyzer, or submit your own file for analysis.