MALICIOUS
206
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.5513
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINKPDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://mifuj.co.za/XSRYdR1H?utm_term=colour+atlas+of+veterinary+pathology+pdf PDF link annotation
- https://stthomasorthodoxchurchsouthpampady.com/userfiles/file/1169747583.pdfIn PDF document text
- http://mijneigenlift.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161dbc49b21d8d---gabutu.pdfIn PDF document text
- http://daotaoyduoc.org/wp-content/plugins/super-forms/uploads/php/files/d692fc2ab6cbdc5df98223252efaa532/xulaviwov.pdfIn PDF document text
- http://www.sosonomo.com/ckfinder/userfiles/files/48945532140.pdfIn PDF document text
- https://www.denisonlandscaping.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613d37945031d---wivinogiwijemokaled.pdfIn PDF document text
- http://congtrinhxanh.vn/media/images/upload/files/37747669080.pdfIn PDF document text
- https://frontiermyanmar.com/sites/all/libraries/ckfinder/userfiles/files/80403573047.pdfIn PDF document text
- http://laiksmodalux.lt/app/webroot/uploads/userfiles/files/faketazinuwejalomodezuri.pdfIn PDF document text
- http://premiumdrinks.eu/userfiles/sikemiburepajuzeraxasil.pdfIn PDF document text
- https://foodthings.us/userfiles/file/botapelafep.pdfIn PDF document text
- http://concienciafiscal.com/kcfinder/upload/files/vujuwuv.pdfIn PDF document text
- http://yds-wcv.jp/free_images/files/21052553034.pdfIn PDF document text
- http://nh3.ifca.com/userfiles/file/75809289887.pdfIn PDF document text
- http://nuyewpilot.academy/wp-content/plugins/super-forms/uploads/php/files/18ba20fa1b3135d5f15c10c8e2098224/mazujubemaparixurerenoz.pdfIn PDF document text
- https://santehsevast.ru/userfiles/files/nijuju.pdfIn PDF document text
- http://rezervacie.ambio.sk/user_files/files/voxij.pdfIn PDF document text
- http://chemicalengineers.ie/images/naditoz.pdfIn PDF document text
- http://destock-groupe.com/userfiles/file/poxanewanajobage.pdfIn PDF document text
- http://world-green-hope.com/uploads/files/35612382984.pdfIn PDF document text
- https://alistairmills.com/ckfinder/userfiles/files/39799735845.pdfIn PDF document text
- http://omniatel.it/wp-content/plugins/formcraft/file-upload/server/content/files/161a5206890d9b---nawebofuberofopajo.pdfIn PDF document text
- https://tocgia247.com/wp-content/plugins/super-forms/uploads/php/files/7fc804tgh1hrb9g2i8tl3rkpsp/44969396449.pdfIn PDF document text
- http://ahkjt.com/upfile/file/xogojobesijakovamo.pdfIn PDF document text
- http://greenegiving.aboutgiving.net/sites/default/files/editor/file/56752262433.pdfIn PDF document text
- https://macjiboter.macjahisa.si/files/file/67557306406.pdfIn PDF document text
- https://legacytwirlers.cornerfamily.com/userfiles/files/38406231337.pdfIn PDF document text
- http://architettotoma.it/userfiles/files/61255266046.pdfIn PDF document text
- https://ap-qatar.com/userfiles/files/tofuzitupafozoz.pdfIn PDF document text
- http://ivepe-elearning.gr/assets/UserFiles/mainHome/file/38555449502.pdfIn PDF document text
- https://steammining.com/userfiles/file/78457368062.pdfIn PDF document text
- http://studioambienteterritorio.it/userfiles/files/28797517639.pdfIn PDF document text
- https://vida.posilatko.cz/files/wswg/files/20911795095.pdfIn PDF document text
- http://kaupa.cz/userfiles/file/fugemulitiwefil.pdfIn PDF document text
- http://police8coop.com/UserFiles/file/76920169347.pdfIn PDF document text
- https://carparts-fixture.com/file/file/kodalilejakimepipixuz.pdfIn PDF document text
- http://www.thelawchamber.com/wp-content/plugins/formcraft/file-upload/server/content/files/1615ec3ea29e8c---17951644701.pdfIn PDF document text
- https://b2cdemo.tickets.com/content/files/serixezopogewosudopewapej.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00056e04.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x56E04 | 11088 bytes |
SHA-256: c65c08ee5ffcc849efbf57fe1800f46ff6882731ffa7d22ada9a92c4b6cf515a |
|||
font_01_sfnt_off000587a7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x587A7 | 16020 bytes |
SHA-256: 0a554f0156e5287469d371c0303085318d079e999124761bf13c095af2a97dcd |
|||
font_02_sfnt_off0005b118.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x5B118 | 16416 bytes |
SHA-256: cfa2c3fbce80cc5607e01af033b793d17c57c214fb1d96e845eedea48cccd336 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.