MALICIOUS
94
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document is designed to deceive users by impersonating university joining instructions. It contains a link farm pointing to various URLs, many hosted on compromised CMS uploads, which likely serve as a distribution point for malicious payloads. The ML classifier also flagged this PDF as malicious, increasing confidence in its malicious intent.
Machine Learning
- Nyx PDF Classifier malicious score 0.7284
Heuristics 4
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pixomot.ru/uplcv?utm_term=mwalimu+nyerere+university+joining+instruction+pdf
- http://mai-colle.jp/userfiles/file/nuguruxopobenimifon.pdf
- https://amartzon.store/wp-content/plugins/super-forms/uploads/php/files/1994c83f952c351465dd61d11c495f74/70183662245.pdf
- https://smithsgame.com/calisma2/files/uploads/reverisujavujapojoluli.pdf
- https://robinio.de/wp-content/plugins/super-forms/uploads/php/files/v8e52jac4ejtbfb87d25h5pkv9/movopomozopugexiguwepowa.pdf
- https://vdbergelectro.nl/wp-content/plugins/super-forms/uploads/php/files/e7933028362ec1c41befb9f6b6993053/46366912863.pdf
- http://vyveva.eu/UserFiles/File/kivesikimipa.pdf
- http://tillmanfamilyreunion.com/clients/b/b7/b7385abc5988d1ee605fea7695e3d00e/File/kitixibufiwazokipiz.pdf
- https://specialbrands.gr/wp-content/plugins/super-forms/uploads/php/files/ae304f2ac2de3f3ab8b3d415ff46fc69/34610568990.pdf
- https://www.pharmaright.ca/wp-content/plugins/super-forms/uploads/php/files/st0bobgvrkdb2jtbkt1br0t5fl/kijarofimebe.pdf
- http://miamiwars.pl/wp-content/plugins/super-forms/uploads/php/files/938114f9a432570f36123dcef9029f3d/52184690098.pdf
- http://tnslib.net/userfiles/files/27284448956.pdf
- http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a04cfa0708d---vumomanejufebodalebefeg.pdf
- http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/1609ca941191e8---85182994794.pdf
- https://www.anandtirth.com/wp-content/plugins/super-forms/uploads/php/files/7fc2tm6g5vht82dctlgjakq554/visidaneg.pdf
- https://augsburger-dartliga.de/uploads/file/90196807668.pdf
- http://ty-universe.com/image/files/20210530_104344.pdf
- https://bistro-8.com/wp-content/plugins/super-forms/uploads/php/files/c31875a94700b88e50776e5c13822e44/fumibupinetup.pdf
Open this report in the interactive analyzer, or submit your own file for analysis.