MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous embedded URLs, many of which point to compromised CMS uploads or disposable hosting, indicating a link farm designed to obscure the final destination. ClamAV detected this file as Pdf.Phishing.Trojan, and ML classifiers also flagged it as malicious. The presence of a link farm suggests an attempt to lure users to external sites, likely for phishing or to download further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.5210
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://catamma.ru/uplcv?utm_term=bending+time+and+space PDF link annotation
- https://hoatuoi360.vn/uploads/files/47674233362.pdfIn PDF document text
- http://phaptangpgvn.net/app/webroot/upload/files/58282365265.pdfIn PDF document text
- https://barcelona-health.com/files/galeria/files/69216174612.pdfIn PDF document text
- http://fteq.ru/files/file/65783954933.pdfIn PDF document text
- http://bjjiffy.com/upload/sebenez.pdfIn PDF document text
- http://poomseoul.com/userfiles/file/2110356.pdfIn PDF document text
- http://ace-pharm.com/upload/files/98478827679.pdfIn PDF document text
- http://diadiemvui.com/upload/files/86872447989.pdfIn PDF document text
- http://norilskgu.ru/userfiles/file/dapazevudunigubibokujonuz.pdfIn PDF document text
- http://ymjgolf.com/file_media/file_image/file/puvegoxadibekapiwerinofe.pdfIn PDF document text
- http://setunari.com/uploads/news/2021/10/20/file/kopasajebomevaroneja.pdfIn PDF document text
- https://adsbudget.net/userfiles/file/fanunurujidekavivo.pdfIn PDF document text
- http://bernendorf.ru/userfiles/file/mudugurukoxegebez.pdfIn PDF document text
- http://dailitara.lt/bites/uploads/file/vugirimerevojojunub.pdfIn PDF document text
- http://www.77ice.com/upload/files/63491597432.pdfIn PDF document text
- https://mymovingestimate.com/wp-content/plugins/super-forms/uploads/php/files/7753f9e32d730a471849becfc73f299d/tebebapolidedexulofiluvaf.pdfIn PDF document text
- http://xn----ctbguteehkho5h.xn--p1ai/ckfinder/userfiles/files/bigudepafitiveduwumusewa.pdfIn PDF document text
- http://citlak.de/admin/UserFiles/file/jojojenavujuzonow.pdfIn PDF document text
- http://penetrat.ru/files/files/bezexakawokaganak.pdfIn PDF document text
- https://flylights.pl/wp-content/plugins/super-forms/uploads/php/files/lo8dgdof6619d5u2i3ug47f8gh/katasupaxalexumevuv.pdfIn PDF document text
- https://ta-taiwan.com/app/webroot/userfiles/files/29893278529.pdfIn PDF document text
- http://dawahcity.com/userfiles/file/suxopulikekugupojusujap.pdfIn PDF document text
- http://smartdeal.pl/files/upload/files/zotajajepanunuxulibabuv.pdfIn PDF document text
- https://alperbehang.nl/userfiles/file/gajalorevozodirepiwe.pdfIn PDF document text
- https://sg-design.top/wp-content/plugins/super-forms/uploads/php/files/cf71d5ba0b758a6f2ecaccd517bc23b3/86236288220.pdfIn PDF document text
- https://chasehr.in/userfiles/file/zakelafoxazipe.pdfIn PDF document text
- http://samurairamenbar.com/uploads/files/60012932097.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000104b1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x104B1 | 10644 bytes |
SHA-256: 0639205fd499655b80d8b04e568abccd1c0be1b8bf65e418442aa172084dd2d0 |
|||
font_01_sfnt_off00011ce4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11CE4 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.