MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file is identified as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains multiple links to external websites, some of which are hosted on compromised WordPress installations, suggesting a phishing or malware distribution scheme. The document body, though heavily obfuscated, contains references to 'Classical piano pieces pdf' and 'wkhtmltopdf', likely serving as a lure to disguise the malicious links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9969
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pixomot.ru/uplcv?utm_term=classical+piano+pieces+pdf PDF link annotation
- https://allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/f7bb505319557df7e2ff639d31fa0651/dokesuvowujuxas.pdfIn PDF document text
- http://www.iqubz.com/wp-content/plugins/formcraft/file-upload/server/content/files/16085001868c54---xapabinafosidekeniliwiwo.pdfIn PDF document text
- https://oddluzanie.net/userfiles/file/46277616682.pdfIn PDF document text
- https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/7pfah9nr2j6gnf1f1k152a1r0v/manuvuwo.pdfIn PDF document text
- http://cedresarquitectura.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb7f466b48f---kutuladabajix.pdfIn PDF document text
- http://www.maarsehoveniers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160a6df5460d35---fifejuxuliw.pdfIn PDF document text
- https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/9ffa9702556bcf21f8619bc7c719e662/nigirirokenez.pdfIn PDF document text
- http://mesotects.com/wp-content/plugins/formcraft/file-upload/server/content/files/160807d110dc6b---kavexopumibagarenon.pdfIn PDF document text
- https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/160712f1db95f9---71251770971.pdfIn PDF document text
- https://www.actionconstructionjax.com/wp-content/plugins/super-forms/uploads/php/files/85aa148816783886aae3fc80ef394f8b/wipokisumefoterusupu.pdfIn PDF document text
- http://biomassasia.net/data_ed/userfiles/file/31220370711.pdfIn PDF document text
- http://www.cuerpomenteyespiritu.es/wp-content/plugins/formcraft/file-upload/server/content/files/160757beb574be---mamowowuvobavoturisaluko.pdfIn PDF document text
- https://sdyh.gr/wp-content/plugins/super-forms/uploads/php/files/ef0f8rcdiphheuh8rjiilrd0a5/98809322325.pdfIn PDF document text
- https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/2f51d90e98e4031c57b27f7920177298/46486639948.pdfIn PDF document text
- https://www.sacda.org/wp-content/plugins/super-forms/uploads/php/files/f5vfkompf0eip0mfeaegkkf343/sabujamigemoduf.pdfIn PDF document text
- http://meble-tk.pl/userfiles/file/88679727877.pdfIn PDF document text
- http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16072339fa39f6---dirilofel.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000dffe.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDFFE | 4960 bytes |
SHA-256: 7edadba765537e7e58aef8350b5cab9696a214137fd4e04ddb17922216c08eca |
|||
font_01_sfnt_off0000f0ee.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF0EE | 11148 bytes |
SHA-256: f1809faa17ac60a8f7452e50fbc73bfcf71e1db92ae70c870bbb244f7df32c1c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.