MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains a large number of links, many pointing to compromised CMS upload directories, indicating it functions as a link farm. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports a malicious intent, likely to lure users to phishing sites or download further malware. No scripts were extracted, but the structure and URL patterns are indicative of a malicious PDF.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3358
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://thuaphatlaihoanghuy.com/uploads/files/kenif.pdf In PDF document text
- http://tasarimak.net/ckfinder/userfiles/files/wejez.pdfIn PDF document text
- http://www.julitolaschools.com/wp-content/plugins/formcraft/file-upload/server/content/files/160779f7cc792b---gatepejunebit.pdfIn PDF document text
- https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/ed46a8116ab539e89b24bd325713b58e/kijuma.pdfIn PDF document text
- http://domholidays.com/userfiles/file/79142958429.pdfIn PDF document text
- https://areshin.ru/wp-content/plugins/super-forms/uploads/php/files/a423afd82b6141b44da21c9cc6bf0b58/muvepov.pdfIn PDF document text
- https://classicandcamper.co.uk/wp-content/plugins/super-forms/uploads/php/files/q415tnp170ui2kp12f7dvi8j7g/37385817412.pdfIn PDF document text
- http://orem.mn/uploads/files/fizobigujun.pdfIn PDF document text
- https://qamarapps.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c26601e5ab4---5934853234.pdfIn PDF document text
- http://airfa.it/userfiles/file/wowukajatunisogan.pdfIn PDF document text
- http://www.eflox.net/wp-content/plugins/formcraft/file-upload/server/content/files/16079278ac3cad---ragagibabufesudune.pdfIn PDF document text
- https://www.bocamvigliesrooms.com/wp-content/plugins/super-forms/uploads/php/files/c4722eb8e5827f22a2180cb6d1b8dd42/zidewaxuxamozusigeximasu.pdfIn PDF document text
- http://www.britocunhaadvocacia.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/16081e89f34254---nasuzavujuj.pdfIn PDF document text
- https://rockyshairsalon.com/wp-content/plugins/super-forms/uploads/php/files/epoovj5kqkeptiqe5a4hkm9vv5/14350959196.pdfIn PDF document text
- http://pebyte.com/wp-content/plugins/super-forms/uploads/php/files/0t3k07mcs1793f35s4gqmlf47i/jozoberexanesozowefa.pdfIn PDF document text
- http://chiron-ventures.com/chiron/home/img/upload/files/210714075830653335g2xo6.pdfIn PDF document text
- http://sz-nuoyi.com/Upload/file/2021090110031581945.pdfIn PDF document text
- http://a2itsolutions.com/chop/multimedia/userfiles/file/19328706641.pdfIn PDF document text
- http://matstravel.ru/userfiles/file/3444426732.pdfIn PDF document text
- https://www.synergyheart2heart.team/wp-content/plugins/super-forms/uploads/php/files/lh22drcustbj6ren9q2b7rb4d9/53858521102.pdfIn PDF document text
- http://re-view.online/fckFiles/file/legofubilorake.pdfIn PDF document text
- http://spreewaldatelier.de/img/editor/file/18787426871.pdfIn PDF document text
- http://ydtmuhendislik.com/ckfinder/userfiles/files/63186140859.pdfIn PDF document text
- https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082d8d9f1a94---85649019820.pdfIn PDF document text
- http://kovacsoltvaskerites.hu/images/file/31427457478.pdfIn PDF document text
- http://covina.crazyrockinsushi.com/uploads/files/9867609667.pdfIn PDF document text
- http://domholidays.com/userfiles/file/38362851191.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=armed+conflict+in+the+philippines+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eb24.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB24 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00010336.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10336 | 17436 bytes |
SHA-256: eff619a233bb0c4c404b150eecf8a2656439f2324dba6ba49741952ca8b1220d |
|||
font_02_sfnt_off00013039.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13039 | 10704 bytes |
SHA-256: 0c155b000732cacaed45645ea2af7f82fb053a58881708aebfd7c84643b49058 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.