MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous links to compromised WordPress sites, indicating it functions as a link farm. The ML classifier and ClamAV detection strongly suggest malicious intent, likely for phishing or distributing further malware. The embedded URLs are the primary indicators of compromise.
Machine Learning
- Nyx PDF Classifier malicious score 0.9678
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://archism.ru/uplcv?utm_term=idolmaster+starlight+stage+guide
- https://thealloywheelcentre.co.uk/wp-content/plugins/super-forms/uploads/php/files/82bcec738ccc3feb4418eeecc53dbb8a/tagiluxugirepotunukaze.pdf
- http://saludocupacionalpso.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/1606fa1f480cae---55196848885.pdf
- http://www.fullmooneye.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bfb7d2b2677---47844551130.pdf
- http://musorcentrum.hu/files/article/file/75767393897.pdf
- http://svs-pm.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d4dde6335e---2448941918.pdf
- https://caravanandre.it/wp-content/plugins/super-forms/uploads/php/files/5f0c4f6f7e3a98a7fbae1bd8d48c7a99/biwififu.pdf
- https://finestblogger.de/wp-content/plugins/super-forms/uploads/php/files/0lsvs8a44ot9ed2csb939heh2i/23840242401.pdf
- https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/246ba4f7f7e67c4d0b03f854733f97ae/menizidusuzonepawidad.pdf
- http://akcjonariusz.com/UserFiles/file/zifot.pdf
- https://www.alphaveneers.com/wp-content/plugins/super-forms/uploads/php/files/66f1a2816f0dd8f0f0d9858433c0ae8d/ketemikixixevexunizorod.pdf
- http://playeasypiano.com/resources/fck_images/safina.pdf
- https://www.etbsupplies.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606e10c40411f---sukowetokoxuvaranofofile.pdf
- http://pelesiuvalymas.lt/i/File/32037652009.pdf
- https://firsatpin.com/calisma2/files/uploads/25799121007.pdf
- http://goteneplast.se/files/images/file/motetuzunalubafiva.pdf
- https://worldkelo.com/wp-content/plugins/super-forms/uploads/php/files/41903ee0866d736adaadb98b7d28dd73/92556924732.pdf
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b4dec871d17---17563518216.pdf
Open this report in the interactive analyzer, or submit your own file for analysis.