MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The file is identified as malicious by ClamAV with a 'Pdf.Phishing.Trojan' signature. Static analysis reveals it functions as a link farm, containing numerous URLs pointing to potentially compromised WordPress sites. These links likely serve to redirect users to malicious content or phishing pages, a common tactic for initial compromise.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4208
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://asu.com.vn/wp-content/plugins/super-forms/uploads/php/files/mkjshmj39k0jkq1uo1qdcfole7/bijitaxovuguwepo.pdf In PDF document text
- http://extreamtuning.ru/wp-content/plugins/formcraft/file-upload/server/content/files/16072adb0b8044---65911932470.pdfIn PDF document text
- http://woonhuislift.info/wp-content/plugins/formcraft/file-upload/server/content/files/1607d6b17787d0---82138985926.pdfIn PDF document text
- https://nutstudio.it/userfiles/file/xilixufaz.pdfIn PDF document text
- https://www.mysmilestudios.com/wp-content/plugins/super-forms/uploads/php/files/a64b16d6c34f66a279f53ce0d5bd4418/36508214908.pdfIn PDF document text
- https://bursaceviritercume.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b96ce3ac446---temuzasemug.pdfIn PDF document text
- https://ccveg.org/wp-content/plugins/super-forms/uploads/php/files/ahfc6pu6h8vkai20pascgrnktd/ginadeli.pdfIn PDF document text
- https://www.goldenplanet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/160e4c9b530e28---63983553869.pdfIn PDF document text
- https://sipare.com.ar/wp-content/plugins/super-forms/uploads/php/files/f773o80dn9onu6q4jufglf3b64/zigujomo.pdfIn PDF document text
- https://helicopterleasingservices.com/userfiles/files/61722307029.pdfIn PDF document text
- https://birotex.rs/images/files/fobetamet.pdfIn PDF document text
- https://cooperspick.com/files/2363354922.pdfIn PDF document text
- http://lifemartrealestateconnect.com/wp-content/plugins/super-forms/uploads/php/files/vi4rfs0dkqkbs31d5bgb7sdrn6/18669925297.pdfIn PDF document text
- http://hesexpo.com/img/editor/image/file/zanatosilul.pdfIn PDF document text
- http://vudafrique.com/wp-content/plugins/super-forms/uploads/php/files/16f94e054b7d79bc0f4e8cc5e6a5c44e/59039768859.pdfIn PDF document text
- https://betonwerkendejonge.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160b43d6fed7fe---89466170112.pdfIn PDF document text
- http://www.birapart.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d46e3c610c---13507074264.pdfIn PDF document text
- http://tele-video.ru/upload/files/zevuporukofodewadafimodo.pdfIn PDF document text
- https://fundreamz.com/ckfinder/userfiles/files/87222426794.pdfIn PDF document text
- https://www.lowdoc-loans.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1607bd88c3bc31---39098817410.pdfIn PDF document text
- https://moto-trend.cz/public/files/fck/file/sujukipimus.pdfIn PDF document text
- https://alkhairi.co.uk/wp-content/plugins/super-forms/uploads/php/files/8fd7d149295b6796519e6e3c52f0f665/bikalomip.pdfIn PDF document text
- http://bestofbeer.ru/ckfinder/userfiles/files/29319419866.pdfIn PDF document text
- http://eksan-ltd.com/userfiles/file/28828826658.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=how+much+is+a+cadillac+converter+worthPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e7c4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE7C4 | 10876 bytes |
SHA-256: 1e9d26c1425dfd02eb10d4a5502ea5e73c47e2338a2bc4f7036f6c5d0cb77d08 |
|||
font_01_sfnt_off000100be.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100BE | 16876 bytes |
SHA-256: 1fb4de862850122d26c35fb8c5d7e8e7020e0691c02ade296e7cdd9774ef39e5 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.