MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains numerous embedded URLs that point to compromised WordPress sites and other disposable hosting. These links likely serve as a link farm to redirect users to malicious content or phishing pages. The ClamAV detection and ML classifier further support the malicious nature of this PDF, indicating it is likely a phishing or trojan delivery mechanism.
Machine Learning
- Nyx PDF Classifier malicious score 0.5548
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://philabc.ru/uplcv?utm_term=tirinha+com+ora%C3%A7%C3%A3o+subordinada+adjetiva+explicativa PDF link annotation
- http://www.kindytennis.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609839669818c---vokekakulolunokepi.pdfIn PDF document text
- http://maradonasalud.com.ar/ckeditor/ckfinder/userfiles/files/11615352740.pdfIn PDF document text
- https://kayakbranson.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5e58924ccf---85981487439.pdfIn PDF document text
- https://sabunwangi.com/contents//files/xifiwulag.pdfIn PDF document text
- http://abwplazaview.com/uploads/files/83108392144.pdfIn PDF document text
- http://vdadanang.vn/app/webroot/assets/files/wiseretokinuwokureputi.pdfIn PDF document text
- http://www.contal-farmer.com/uploads/files/rulupetokajusesepejujow.pdfIn PDF document text
- http://zaragozalawoffice.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/23413098320.pdfIn PDF document text
- http://bioscipublisher.com/files/upfiles/file/fijabibenaperex.pdfIn PDF document text
- http://ranaghatpchsschool.org/userfiles/file/lelolibuzadederepefi.pdfIn PDF document text
- http://4998horo.gmmwireless.com/contents/files/71976395082.pdfIn PDF document text
- http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160869a8cdf773---79370417175.pdfIn PDF document text
- http://hgbs.de/userfiles/file/zafodilejowupipava.pdfIn PDF document text
- https://wilocom.ro/ckfinder/userfiles/files/91184818482.pdfIn PDF document text
- http://allasclub.com/campannas/file/fugolenidetoxa.pdfIn PDF document text
- https://alatheir.com/atheirwsfiles/file/debavakavikejikapa.pdfIn PDF document text
- https://trucraftsmanship.com/wp-content/plugins/formcraft/file-upload/server/content/files/160866957f36a7---1300190635.pdfIn PDF document text
- https://alismobile.co.uk/wp-content/plugins/super-forms/uploads/php/files/18667a47fbb7b58f808f60a9458673c6/tufuvej.pdfIn PDF document text
- http://www.webtony.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16076616d7872b---fepiguvubelapivotodigub.pdfIn PDF document text
- http://copelandreunionla.com/clients/6/66/66f6f3de7053633686652f51c4c00696/File/80705395290.pdfIn PDF document text
- http://objetivovender.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c5f59a4eb4---44337377706.pdfIn PDF document text
- http://ipjanah.ir/wp-content/plugins/super-forms/uploads/php/files/lh4ukrtos8pb39gee26p6sm8m9/jekadaduvorekefelujutu.pdfIn PDF document text
- http://www.moteco.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1608f3a2c33e9f---fujefuvigido.pdfIn PDF document text
- http://busanpc1.com/upload/fckeditor/file/50921822178.pdfIn PDF document text
- https://www.growxponential.com/wp-content/plugins/super-forms/uploads/php/files/g9l81mvupe3e06b5sqaiaseahd/silowufarozu.pdfIn PDF document text
- http://rld-carbon.ru/file/dafipolijibizivokad.pdfIn PDF document text
- http://rolmech-strzelno.pl/Upload/file/48265270332.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e531.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE531 | 11744 bytes |
SHA-256: d23f9f3fd56eb7fb6a7c59f7c02cd80ef232ba98a7b1cd9a99e731b6b445d09d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.