MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous embedded URLs, many of which point to compromised websites or link farms designed to redirect users. Heuristics indicate it's a link farm on disposable hosting and potentially points to compromised CMS uploads. ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely phishing or malware delivery through these links.
Machine Learning
- Nyx PDF Classifier malicious score 0.7316
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://sharon-barron.com/userfiles/files/xasutorivujaku.pdf In PDF document text
- https://armandofalconi.net/userfiles/file/54968066039.pdfIn PDF document text
- https://apparel.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/87efd922d5256e213289b538a5c32baa/48093869835.pdfIn PDF document text
- http://enslev-anlaegsservice.dk/userfiles/file/25707183061.pdfIn PDF document text
- http://waukeganeast1980.com/clients/877304/File/37545994771.pdfIn PDF document text
- http://emke.hu/uploads/ckfinder/userfiles/files/tuzune.pdfIn PDF document text
- http://unsersohn.ch/images/file/jeniba.pdfIn PDF document text
- http://www.dilipprabhavalkar.com/images/file/simetitezopoxew.pdfIn PDF document text
- http://shipsupply.ru/userfiles/files/63234660803.pdfIn PDF document text
- https://mygamedaysports.com/wp-content/plugins/super-forms/uploads/php/files/bd38d52d788c5285f0776ffe1b23ede4/suboxadejuferusirero.pdfIn PDF document text
- http://boulderdivorcelaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607acc458679a---nakodagi.pdfIn PDF document text
- http://cestovni-postylka.eu/userfiles/file/rafuvizenizobinorabi.pdfIn PDF document text
- http://imaginove.eu/data/Files/zefanoteb.pdfIn PDF document text
- https://karinbentum.nl/uploads/file/viwozoguxoneli.pdfIn PDF document text
- http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8d972a254---legebolodiwaludemukegax.pdfIn PDF document text
- https://almoheetmanpower.com/public_html/userfiles/file/45368260236.pdfIn PDF document text
- http://lifestyleufa.ru/wp-content/plugins/super-forms/uploads/php/files/027bbe84f459429a7bcce588e57ba466/letim.pdfIn PDF document text
- https://expresstestingatl.com/wp-content/plugins/super-forms/uploads/php/files/f7b9e2ca77c1d091b6a4df8f365420b4/81446522607.pdfIn PDF document text
- http://www.rec39.ru/wp-content/plugins/super-forms/uploads/php/files/6d9556a8b2d7a85be7628f18feb714b5/wesasujakuben.pdfIn PDF document text
- https://ehlibeytalimleri.com/resimler/files/5761322768.pdfIn PDF document text
- http://border-inn.com/CKEdit/upload/files/37710166488.pdfIn PDF document text
- https://www.novet.de/wp-content/plugins/formcraft/file-upload/server/content/files/160aca2982c7fa---zawuzatazo.pdfIn PDF document text
- http://eros-arena-reutlingen.de/eros/userfiles/file/tizado.pdfIn PDF document text
- https://levin-dent.ru/wp-content/plugins/super-forms/uploads/php/files/5daa3e8c9efd51c0addef5a2af34a8c9/mezamolinizoj.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=blood+sisters+castPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000121d3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x121D3 | 10312 bytes |
SHA-256: dac2be0da98b1b4da744d56632305dd27a3195738d60eba610d0dcd7f2fd6088 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.