MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a large number of embedded URLs, many of which point to compromised WordPress upload directories. The ClamAV detection indicates this is a known phishing or trojan distribution mechanism. The heuristic firings suggest the sample is a link farm designed to redirect users to malicious content hosted on potentially compromised websites.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3499
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.spoton.pet/wp-content/plugins/super-forms/uploads/php/files/74fv3aodm7kojgme0cqe3ch679/rizonefavenuju.pdf In PDF document text
- https://sammycar.ch/sammy/sites/default/sammyfiles/newsletterfile/40424714252.pdfIn PDF document text
- https://completecollegestrategies.com/wp-content/plugins/super-forms/uploads/php/files/604c4a9b124e7daacad25bda5d83df59/vivesas.pdfIn PDF document text
- https://www.physioaktivkramer.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608a48b6c9306---82807779136.pdfIn PDF document text
- http://ccadl.com/files/20210825043640.pdfIn PDF document text
- http://solyaris.pro/admin/ckfinder/userfiles/files/31232945574.pdfIn PDF document text
- https://poldercuptrofee.nl/site/admin/ckfinder/userfilesfiles/55750077363.pdfIn PDF document text
- http://aow.infogestnet.it/ckfinder/userfiles/files/zuwelofukafasexabogijovuj.pdfIn PDF document text
- https://wisestudentz.com/userfiles/file/7122924165.pdfIn PDF document text
- http://willtorock.com/wp-content/plugins/formcraft/file-upload/server/content/files/1611787c966116---87114837007.pdfIn PDF document text
- http://novosib-sport.ru/ckfinder/userfiles/files/nidodolijumo.pdfIn PDF document text
- https://www.enviedecrire.com/wp-content/plugins/formcraft/file-upload/server/content/files/16094c9e19b2e8---82586348569.pdfIn PDF document text
- http://agro-pasz.pl/ckfinder/userfiles/files/43158384614.pdfIn PDF document text
- http://abpaluso.com/upload/file/77040310060.pdfIn PDF document text
- https://apoc.com.au/wp-content/plugins/super-forms/uploads/php/files/81bb9b33ec05054e64c4a18d140dd762/savujeruwebakebewebo.pdfIn PDF document text
- http://longhornrings.com/clients/0/08/08da48574b41509ac7bedcf2500dc652/File/86027245343.pdfIn PDF document text
- http://botosani.ro/img/uploads/file/72724621123.pdfIn PDF document text
- https://www.indee-r.fr/wp-content/plugins/super-forms/uploads/php/files/a1d9ba786fdefbb63ced4f54598fd966/wezaxegazevaviboredeju.pdfIn PDF document text
- https://www.vigo.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160fdce1003f47---30690682407.pdfIn PDF document text
- http://famcareconnect.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609d5a7215edb---49519396119.pdfIn PDF document text
- http://www.1atlanticfunding.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c26643ef02e---75772018260.pdfIn PDF document text
- https://cullinanconstruction.com/wp-content/plugins/super-forms/uploads/php/files/c47ep7qlm8r146curuu0ssbo4h/65184748716.pdfIn PDF document text
- http://mygotour.com/FileData/ckfinder/files/20210606_5DF07054421BBA78.pdfIn PDF document text
- https://datajournonepal.org/files/53822563206.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=mary+mother+of+perpetual+help+prayerPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f68b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF68B | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00010ea2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10EA2 | 10464 bytes |
SHA-256: 506107c720e61448ffe45542781c039dbfb4665779f232ceb230c6aa9e64bf7c |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.