MALICIOUS
174
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.6043
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fecuq.co.za/XSRYdR1H?utm_term=google+slides+templates+food PDF link annotation
- https://mimpiindah88.com/contents/files/gakuliname.pdfIn PDF document text
- https://pollackmihalyiskola.hu/ckfinder/userfiles/files/63897431444.pdfIn PDF document text
- https://nicemexico.net/wp-content/plugins/formcraft/file-upload/server/content/files/161ac4510204bf---85727868886.pdfIn PDF document text
- http://hrampetraipavlavosstanovlenie.ru/content/images/user/file/zedepev.pdfIn PDF document text
- http://ayhancevik.com/images_upload/files/87365380572.pdfIn PDF document text
- https://sbmhavacilik.com/userfiles/file/38698705911.pdfIn PDF document text
- http://short-story.ru/upload/file/fituze.pdfIn PDF document text
- https://goodnest.info/tctt/sites/aaa/file/vakirugalisuvulebidazoxun.pdfIn PDF document text
- http://debeleven.net/UserFiles/File/36740901901.pdfIn PDF document text
- http://www.galiantsolutions.com/emailimages/file/79004982731.pdfIn PDF document text
- http://reclaimsplus.com/wp-content/plugins/super-forms/uploads/php/files/283e0d271ec84298305dfbee0b286b64/febekukupo.pdfIn PDF document text
- http://bkmarine.net/ckfinder/userfiles/files/1627776301.pdfIn PDF document text
- https://2-view.org/home/view/public_html/ckfinder/userfiles/files/94289758360.pdfIn PDF document text
- http://csc025.com/userfiles/file/20220123062401_txe8gs.pdfIn PDF document text
- http://hosma.net/upload/files/xutenamuresu.pdfIn PDF document text
- http://svatba-emi.com/uploads/pages/files/65665322719.pdfIn PDF document text
- https://lazeo.nl/userfiles/file/lipugefusewarigatamomer.pdfIn PDF document text
- http://debsluxe.com/clients/1/17/174397649ed9f07baa8f9d9f48c72a4d/File/64177856911.pdfIn PDF document text
- http://www.airportlimofortlauderdale.net/wp-content/plugins/formcraft/file-upload/server/content/files/161f1fbb362e09---wofejujoj.pdfIn PDF document text
- https://www.dishdivvy.com/wp-content/plugins/super-forms/uploads/php/files/4e9a47b98dd85e63f8762a9bf1278c62/wudatokozevutidimi.pdfIn PDF document text
- https://www.carlosfunes.es/wp-content/plugins/formcraft/file-upload/server/content/files/16125337347491---32081365288.pdfIn PDF document text
- https://arvikabc.com/images/uploadedimages/file/68101888772.pdfIn PDF document text
- http://fireprovietnam.net/luutru/files/judefumexogonediwivaxezox.pdfIn PDF document text
- https://juvelyrikoscentras.lt/Files/file/xivubinunisudojodapago.pdfIn PDF document text
- https://www.isgs.org/wp-content/plugins/super-forms/uploads/php/files/45bc623ae930ea73c0ec16a6b92a7d8d/lixot.pdfIn PDF document text
- http://filtrydokoparek.pl/img/all/vimifefiso.pdfIn PDF document text
- https://veglifekc.org/wp-content/plugins/super-forms/uploads/php/files/jexuwubepirinexilibamat.pdfIn PDF document text
- http://fijiembajak.com/uploads/ck_uploads/files/mibem.pdfIn PDF document text
- http://bobas24.pl/Upload/file/kokikukituro.pdfIn PDF document text
- http://ecohost.ru/pics/images/file/befumusivamozofisedidonu.pdfIn PDF document text
- http://cwsf2013.sfiab.com/data/userfiles/file/wexokozatamepixu.pdfIn PDF document text
- http://frutapac.es/ckfinder/userfiles/files/86249622821.pdfIn PDF document text
- http://cctechlaw.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/26293000791.pdfIn PDF document text
- http://www.lavalledesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/1619100f7634b4---defilige.pdfIn PDF document text
- https://suemsas.com/wp-content/plugins/super-forms/uploads/php/files/9fqtsoguvmcprhur7kkdrdusk5/29364309732.pdfIn PDF document text
- http://ptk-astana.kz/wp-content/plugins/super-forms/uploads/php/files/8e71adf4812a25969b47dd2115e69440/xuvezujipijuxixakubimaxu.pdfIn PDF document text
- http://otpetye.com/images/shared/file/wosajowowawegozigamita.pdfIn PDF document text
- http://tindangnhadat.vn/upload/files/vinoxi.pdfIn PDF document text
- http://oresteruggiero.com/userfiles/files/vudaxuw.pdfIn PDF document text
- http://nabisori.com/userfiles/file/48550283851.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000471e2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x471E2 | 17016 bytes |
SHA-256: 8a234d4c6a61e595d31f4ad54905939955c5d64388d12f006593aa751561fa9f |
|||
font_01_sfnt_off00049e4b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x49E4B | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_02_sfnt_off0004b56b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4B56B | 10676 bytes |
SHA-256: 52c37e0ff12ba45959d4c4549639acc4c2ff369b21c66557122c028fc4a04c24 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.