MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains a significant number of links pointing to compromised WordPress installations and other disposable hosting. This behavior is indicative of a link farm designed to distribute malicious content or phish users. The ClamAV detection further supports the malicious nature of this file.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4208
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://thealloywheelcentre.co.uk/wp-content/plugins/super-forms/uploads/php/files/bdf7d346355a36d2284321dcc7539b07/pigexadat.pdf
- https://www.couleurs-et-jardin.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160846f721b919---lakagirulefuriwuvej.pdf
- http://broadgatecapital.com/userfiles/file/nigobiropepat.pdf
- https://thetitangroup.ca/wp-content/plugins/super-forms/uploads/php/files/cef3437c4364331955bb2d878abee13f/vufonagewiwufafuji.pdf
- https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/16084405b4f440---1826165555.pdf
- https://www.ideaklinikkadikoy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c76b81bdd0c---pefigipete.pdf
- http://imi.vc/upload/files/gilemadejo.pdf
- http://etenindex.nl/images/uploads/punabajejuravikofozofo.pdf
- https://puertoestereo.com/wp-content/plugins/super-forms/uploads/php/files/9nmbhvejfucp7h2b3cb8335rc3/81384174335.pdf
- http://www.majorisinvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16092d3df1c50d---60398526010.pdf
- https://www.kiteschule-kiel.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608e1600ab180---89612409287.pdf
- http://bellezaeimagen.com.mx/wp-content/plugins/formcraft/file-upload/server/content/files/16071966780b28---xowixava.pdf
- http://fogathajtohirek.hu/fckfiles/file/92726648471.pdf
- http://theopenhouseclub.com/wp-content/plugins/super-forms/uploads/php/files/20572bf21adb1674f124030f057137f9/52646831130.pdf
- http://massarentearchitettura.com/userfiles/files/91194483085.pdf
- https://rajakeempat.com/contents//files/sabunovezejuwexikemivonos.pdf
- http://kelvista.lt/images/files/turudomobisakemomugozoxo.pdf
- http://dongphuctqueen.com/upload/files/67199944796.pdf
- https://blnk.eu/userfiles/files/votazifugenedegidedov.pdf
- https://web-sila.ru/wp-content/plugins/super-forms/uploads/php/files/919e13aca6322e4b3d80ad2aa7c105f1/26143518160.pdf
- https://cald-lighting.com/wp-content/plugins/super-forms/uploads/php/files/f2bba31916e32ef875ef2b8bf44f9ab7/2884942301.pdf
- https://gulertrafik.com/wp-content/plugins/super-forms/uploads/php/files/5e0fdtp2hfehcqhv5o2d9oi7fe/8784052016.pdf
- http://www.rolstoellift.com/wp-content/plugins/formcraft/file-upload/server/content/files/160efe2715665b---xejadirunuforo.pdf
- http://bannermaul.com/userData/board/file/xemefawolinimujanes.pdf
- https://sirikulsteel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160879da3b2506---tawikejez.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/GLLx1DTH0VQ/uplcv?utm_term=purpose+of+the+introduction+in+an+essay
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ee9d.binc36b4fbda0355797f9b5c1058316ba0201d5154454f76da3b655097d0887549a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEE9D | 10888 bytes |
font_01_sfnt_off000107c6.bind2647f8b7c4b8dd969fc83a2165c20f15fd1b552d25ab4943e6d7f8fbb18d542 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x107C6 | 17456 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.