MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The ML classifier strongly indicated maliciousness, and the PDF contains a link farm pointing to multiple distinct hosts, many of which appear to be compromised CMS uploads. The presence of external URIs and a link farm suggests an attempt to redirect users to malicious sites, likely for phishing or malware delivery. No scripts were extracted, but the structure and URL patterns are indicative of a malicious document.
Machine Learning
- Nyx PDF Classifier malicious score 0.9991
Heuristics 5
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://xn--k1akb4c.xn--p1ai/userfiles/file/bakipijafuxupamujumitut.pdf
- http://www.mondzorgvesa-voorschoten.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c1848e49735---64497205117.pdf
- http://wbbray.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9667cd468f---gawofamewoxopenimewobup.pdf
- https://lisacutler.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b11ff1358e6---lesimilijojelotap.pdf
- https://condominiovillage.com/userfiles/file/gugopopatu.pdf
- https://boucherienabli.com/uploads/FCK_files/file/17017568695.pdf
- http://www.advokat.com/app/webroot/img/fck/file/31751314575.pdf
- https://gpagroup.in/wp-content/plugins/formcraft/file-upload/server/content/files/160ad550d24d5a---mipimitetufevukobamajel.pdf
- http://fence-alarm.com/userfiles/files/neximazosasilukukuwil.pdf
- https://action-roofing.com/wp-content/plugins/super-forms/uploads/php/files/1960b29600efb844fc72c243b59da7cd/1156437471.pdf
- http://bazatalty.pl/wp-content/plugins/super-forms/uploads/php/files/72655ccb6f17900dd8453cb2fe033505/ramegopenadarovowi.pdf
- http://virtualcharityevents.com/vce_cake/files/files/motaxidiputadupepi.pdf
- https://www.hadlowsecurityshutters.com/wp-content/plugins/super-forms/uploads/php/files/f40524ba3fd1b207be29f4f3f21aa1b7/66438138157.pdf
- http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160889ff74cb10---65328731954.pdf
- http://lumieretvie.com/userfiles/file/lizibidawiwizobabam.pdf
- https://polskieplytki.com/wp-content/plugins/super-forms/uploads/php/files/9cb6b4cbe0e96fb0468941bc7dca8359/38652609612.pdf
- https://ludifrance.fr/userfiles/file/koribigigoz.pdf
- http://autoscuolepintozzi.it/userfiles/files/tamapogenenimitafabesuwu.pdf
- http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/9st5im4bpnbp6fg29r75u4gtk4/48148700474.pdf
- http://northwestpixie-bobs.com/clients/e/e1/e1941a3904c49320334fd90e0ed9e852/File/kotasutoguzudir.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1KS0DP0cxss/uplcv?utm_term=your+my+sweetest+downfall
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c3dc.bine74c990832e14d303af192045c8e411369b181c35958a4b0056b408df24e67ca |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC3DC | 17068 bytes |
font_01_sfnt_off0000f097.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF097 | 16792 bytes |
font_02_sfnt_off000108ae.bin31dc06db2b33cd1711ca524f254773db740288ffb269e4adb10a3fc946fdbe14 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x108AE | 10704 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.