MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged by multiple heuristics as malicious, including a high-confidence ML classifier and ClamAV detection. It contains a link farm pointing to compromised WordPress upload directories, suggesting it's part of a phishing or malware distribution campaign. The presence of external URIs and the nature of the detected heuristics indicate an attempt to redirect users to malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.8493
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://chicagohalo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aa41b175e9c---toropiterovumeribi.pdf In PDF document text
- http://dabien.co.kr/wp-content/plugins/formcraft/file-upload/server/content/files/16073f9d741987---nirugaguvolidizudikux.pdfIn PDF document text
- https://antoinepanau.com/wp-content/plugins/super-forms/uploads/php/files/196398b42ca2ab22bc1ac13229db05f2/92020636291.pdfIn PDF document text
- http://recamonde.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c70f87ef259---gudamuk.pdfIn PDF document text
- https://ewastexperts.com/userfiles/files/jenibi.pdfIn PDF document text
- http://beergolfers.com./blog/images/file/24089904105.pdfIn PDF document text
- http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/vl0ne1utkcgs45r1q66rdmlqs6/tixemoro.pdfIn PDF document text
- http://salonlomi.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160d296084006f---11623367009.pdfIn PDF document text
- https://www.nuyew.academy/wp-content/plugins/super-forms/uploads/php/files/b232586d7e618c6dce017f5918ed63b2/38741339805.pdfIn PDF document text
- https://idfusionllc.com/wp-content/plugins/super-forms/uploads/php/files/5fbf353e1d4d41754fc404ef98a77ae1/50452849146.pdfIn PDF document text
- https://www.frontierexim.com/wp-content/plugins/super-forms/uploads/php/files/k5m066lkbrvblko7j8gva5r6fe/peguwoxodemowebezuro.pdfIn PDF document text
- https://realestateconnect.us/wp-content/plugins/super-forms/uploads/php/files/vpbj0a4ai7gbmfc5sofggq55j1/jabezurakowazeri.pdfIn PDF document text
- http://malagi.pl/user-files/fck/file/55373118469.pdfIn PDF document text
- http://leaguengn.com/userfiles/file///kamibaxibivodige.pdfIn PDF document text
- https://foxtailmag.net/wp-content/plugins/super-forms/uploads/php/files/3128c5bca74ee1b4aaa834ef14bd5ca1/89914102429.pdfIn PDF document text
- https://ballestermultiservicios.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e633a1db380---remuxibujusojagipix.pdfIn PDF document text
- http://www.whirlpool-beachcomber.at/wp-content/plugins/formcraft/file-upload/server/content/files/160b83ce0d196c---80314480422.pdfIn PDF document text
- http://eltonltd.ru/sites/default/files/uploads/74462783317.pdfIn PDF document text
- https://beautifullifeuk.com/wp-content/plugins/super-forms/uploads/php/files/82e46be36ce01a204301e84794de4930/38410613811.pdfIn PDF document text
- http://www.teeintact.com/admin/fckeditor/editor/filemanager/connectors/php/img/file/dunurugatunulo.pdfIn PDF document text
- http://thecoferfamily.com/clients/7/78/7892d776c92a08c80f86ebc6236678d2/File/69343000975.pdfIn PDF document text
- http://trungtinjsc.vn/upload/FCK/file/kapozugabovuvazigibetepiw.pdfIn PDF document text
- https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/l2pkpl2lp8auv88gq8k2jhd64k/71965897302.pdfIn PDF document text
- http://caribsplash.org/wp-content/plugins/formcraft/file-upload/server/content/files/160749fc1c9e03---gelekaxakemugezojekibives.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=hillsong+songs+free+download+mp4+audioPDF link annotation
Open this report in the interactive analyzer, or submit your own file for analysis.