MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains embedded JavaScript, which is a common technique for executing malicious code within documents. The sample also exhibits characteristics of a link farm, pointing to multiple compromised WordPress sites, suggesting an attempt to obscure the final malicious destination. ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3632
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://asesoriagarpe.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607875ffee1cc---6961423146.pdf In PDF document text
- http://xn--vb0b83rba554gca.kr/page_data/file/20210507110257.pdfIn PDF document text
- http://j-line.ca/fck_upload/file/2892223772.pdfIn PDF document text
- https://www.hagensmarketing.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b2d5213a1d2---63290285322.pdfIn PDF document text
- https://www.straightmyteeth.eu/wp-content/plugins/super-forms/uploads/php/files/10e148cfd90d35047ab604274e02227b/nukujine.pdfIn PDF document text
- https://pachetedeturism.ro/images/files/tisajimoxusi.pdfIn PDF document text
- https://soechi.id/userfiles/file/tipek.pdfIn PDF document text
- http://lavera.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a2933d2cfff---kemujuxifisi.pdfIn PDF document text
- https://www.lowdoc-loans.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608c472eba967---35775236074.pdfIn PDF document text
- https://www.sodigital.it/wp-content/plugins/formcraft/file-upload/server/content/files/16092fb2399f8c---vuderorulofunupixupove.pdfIn PDF document text
- http://tantos.jp/js/upload/files/55047887326.pdfIn PDF document text
- https://footballsod.com/images/ck-uploads/files/85501602438.pdfIn PDF document text
- http://www.sensible-seeds-premium.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c0cd2b48578---41141111350.pdfIn PDF document text
- https://atx-stroy.ru/wp-content/plugins/super-forms/uploads/php/files/1394b5dbb3450ca16153b7e65f1c0f79/38026275863.pdfIn PDF document text
- https://macleanpinesdrivingschool.com.au/wp-content/plugins/super-forms/uploads/php/files/065f54bff8def166b95e92da1de84b96/49148199010.pdfIn PDF document text
- http://stasta.com/userfiles/file/kabukomavuwizasawigonako.pdfIn PDF document text
- http://nickels.design/ckfinder/userfiles/files/jikadilaferizitodago.pdfIn PDF document text
- https://c4ir.ae/wp-content/plugins/super-forms/uploads/php/files/5nag5qvk99q057bharb89isqs1/9493272665.pdfIn PDF document text
- http://vote4dannybarry.com/clients/2/2f/2f5d4f67c16906f9b09010289963de11/File/39762797390.pdfIn PDF document text
- http://www.ausafrica.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160bce32ae9089---96765161265.pdfIn PDF document text
- http://conservationenergy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ab07e5c058---55171171877.pdfIn PDF document text
- https://laneopx.com/wp-content/plugins/formcraft/file-upload/server/content/files/160881d032c497---vuwesaralexolotoxisakiwi.pdfIn PDF document text
- http://bezpieczna-strefa.pl/wp-content/plugins/super-forms/uploads/php/files/6413f44851b7bc9b69290d7f48566d77/zowazoxixotakudinidit.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=can+watermelons+ripen+after+pickedPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fd6e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD6E | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00011585.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11585 | 10988 bytes |
SHA-256: 097bae7cf0ff7d0d8715586ed33d7338370efde9d65e856985715ebccac531ea |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.