MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file was detected by ClamAV as Pdf.Phishing.Trojan. It contains a link farm pointing to multiple compromised WordPress sites, likely serving as a distribution point for malicious content. The PDF structure and embedded links suggest an attempt to lure users to external resources, aligning with phishing or malware distribution tactics.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3776
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nowbali.co.id/wp-content/plugins/formcraft/file-upload/server/content/files/160a2ff4e0ac7d---80015123657.pdf In PDF document text
- https://humantouchtranslations.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/1609851199b983---56060043451.pdfIn PDF document text
- http://www.derbysignandgraphics.com/uploads/file/bivinil.pdfIn PDF document text
- https://ocvirapuato.com.mx/wp-content/plugins/super-forms/uploads/php/files/9190842f88e90c5a1d325185b8349178/25349159456.pdfIn PDF document text
- http://esangsok.com/upfile/files/35672082195.pdfIn PDF document text
- https://dazzlin.co.uk/wp-content/plugins/super-forms/uploads/php/files/f9ef01a2c4b815bab72614cefbfbd877/23154805084.pdfIn PDF document text
- https://www.msolartop.cz/wp-content/plugins/formcraft/file-upload/server/content/files/1607164dfa1f89---19151853910.pdfIn PDF document text
- http://www.justgiveahand.org/wp-content/plugins/formcraft/file-upload/server/content/files/160ac14238211e---dagilutixufe.pdfIn PDF document text
- https://benchmarktransitions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e1c5bdff85---81536573238.pdfIn PDF document text
- https://lee-trading.tw/archive/upload/files/pokinagujonikali.pdfIn PDF document text
- https://www.potterycommercials.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160a8798e34824---34016067782.pdfIn PDF document text
- http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160de379c27e64---zarozadakedovapefuvofapen.pdfIn PDF document text
- https://nguoixunghekiev.vn/userfiles/file/16917154987.pdfIn PDF document text
- http://willtorock.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ccadd0e1359---10208163411.pdfIn PDF document text
- http://yasaitogo.com/uploads/files/potal.pdfIn PDF document text
- http://hzjksj.com/images/upload/File/ximiduburizal.pdfIn PDF document text
- https://www.truesdalepainting.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607001afacc9b---damin.pdfIn PDF document text
- https://www.hippocratio.gr/ckfinder/userfiles/files/lexaxerekimagiwotiri.pdfIn PDF document text
- https://uaqbakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a847f216896---31949099697.pdfIn PDF document text
- http://principessavencanice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ade6c9b6665---52942113699.pdfIn PDF document text
- https://arerp.kr/data/file///figolekadudebipifotebe.pdfIn PDF document text
- https://cncostruzioni.com/userfiles/file/99286051023.pdfIn PDF document text
- http://www.vitrierbxl.be/wp-content/plugins/formcraft/file-upload/server/content/files/160a9b7e372b11---71526962171.pdfIn PDF document text
- https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c564debc7ae---40906458281.pdfIn PDF document text
- http://sinara.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a5f8dc73338---90646758155.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=lupin+the+third+part+1+episodesPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fad4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFAD4 | 10552 bytes |
SHA-256: 6fa66cd07777a1030e5a75bdd77b4118086a9be1cea73235c4514d025994fc65 |
|||
font_01_sfnt_off000112df.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x112DF | 20252 bytes |
SHA-256: cb4af30e3df38df8a67e6163ee3c284a5d8cedfa1dce3d49792aeb5ad8df2ce0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.