MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file is identified as malicious by ClamAV with a Pdf.Phishing.Trojan signature. Static analysis revealed it functions as a link farm, directing users to multiple compromised WordPress sites and other disposable hosting domains. These links likely serve as a lure for phishing attacks or to distribute further malware.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4855
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.travelticket.com.au/wp-content/plugins/super-forms/uploads/php/files/d6jepcu3k57dtiq1gcbru2jdcv/86406565223.pdf In PDF document text
- http://www.uppld.org/wp-content/plugins/formcraft/file-upload/server/content/files/160785745e7f68---jogexegavaw.pdfIn PDF document text
- https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/a0924b49233cf7b6446dc75659491a0f/62249217452.pdfIn PDF document text
- http://coming-c.com/userfiles/file/jisokujidolusefu.pdfIn PDF document text
- https://www.espymetcalf.com/wp-content/plugins/formcraft/file-upload/server/content/files/16081cf14ef76f---55149820288.pdfIn PDF document text
- https://kassa-evotor.ru/wp-content/plugins/super-forms/uploads/php/files/ftaso3rimtuh78a004je15ghe5/bodiwidorelo.pdfIn PDF document text
- https://aksukartela.com/images_upload/files/vudugegibizixoba.pdfIn PDF document text
- http://royalwedding.jp/images/blog//file/jipevejorotajirowekem.pdfIn PDF document text
- https://alcc.vn/wp-content/plugins/super-forms/uploads/php/files/6th6ug55lsn4phgtegt1qls1q4/raxonivej.pdfIn PDF document text
- http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606cbf936a171---99855849449.pdfIn PDF document text
- http://nd-58.ru/wp-content/plugins/super-forms/uploads/php/files/00681ec6e4c44ffca31673b565b06c76/foruzunetanin.pdfIn PDF document text
- http://asu.com.vn/wp-content/plugins/super-forms/uploads/php/files/746uvcrdk3kf1sek9kg0f7gjk6/firewebidovonetilut.pdfIn PDF document text
- https://fullmagicweekend.com/ckfinder/userfiles/files/kefobe.pdfIn PDF document text
- https://rmdschoolandcollege.com/wp-content/plugins/super-forms/uploads/php/files/gik2svu5hpn4f1mlqn2eheri75/51289812389.pdfIn PDF document text
- https://choiceenergynetwork.com/wp-content/plugins/super-forms/uploads/php/files/8d6a3316abfc1139e9f7e835e1f6dfbe/77862506388.pdfIn PDF document text
- https://ambientltg.com/wp-content/plugins/super-forms/uploads/php/files/538e1abb39ae8749b3313e15782b493a/logiwukifusotibusosex.pdfIn PDF document text
- https://elpmarketing.ca/wp-content/plugins/super-forms/uploads/php/files/60c0c65a1f654d788a1a5e678ee47a3c/mebogifexim.pdfIn PDF document text
- http://www.ibadirect.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c29e60314f2---96510542307.pdfIn PDF document text
- http://gf-location.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160d443bfb0883---revodonakofujomaluw.pdfIn PDF document text
- https://baodinhsolar.com/wp-content/plugins/super-forms/uploads/php/files/6grgoaf8h1ut8idi52pu9n47h0/6486908051.pdfIn PDF document text
- https://www.emmabowman.com/wp-content/plugins/super-forms/uploads/php/files/2f98df72997a91193107f3eba756b181/xebam.pdfIn PDF document text
- http://akkoryazilim.com/userfiles/file/rafedit.pdfIn PDF document text
- http://bitite.lv/media/txt/122/file/36098684805.pdfIn PDF document text
- http://93564497.com/userfiles/zoziliresufibo.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=minuet+and+trioPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000105cd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x105CD | 19036 bytes |
SHA-256: 8f2ec14d58deb6c8c0dad7421cedefeaa9ca5c05e8186f16bdbcfde3a5111654 |
|||
font_01_sfnt_off000136c8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x136C8 | 10120 bytes |
SHA-256: c46ca43e69fe282b6817734e8288e2ea6ec648c9b88caec195077dec5023c21b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.