MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious File
The PDF contains a large number of links, many pointing to compromised WordPress sites hosting other PDFs. This behavior is indicative of a link farm designed to obscure the ultimate destination and potentially distribute malware or facilitate phishing. ClamAV detection and ML classification strongly support its malicious nature.
Machine Learning
- Nyx PDF Classifier malicious score 0.9952
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d1e256a3d3---23450958770.pdf
- http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160afb759a1729---9846106378.pdf
- https://www.brunosistemi.com/wp-content/plugins/formcraft/file-upload/server/content/files/16075fe6798bbc---lodubevapu.pdf
- http://kamerton.nl/clientfiles/vewojagidapifiduk.pdf
- http://www.uppld.org/wp-content/plugins/formcraft/file-upload/server/content/files/160bc28ff0b262---94915073633.pdf
- http://fitviewer.de/files/file/zosoduro.pdf
- http://greenlivinggarden.com/htdocs/UserFiles/file/xefekeno.pdf
- https://www.clubmanizales.com.co/wp-content/plugins/formcraft/file-upload/server/content/files/16072ce3836159---62306850359.pdf
- http://murielbellhomes.com/userfiles/files/3978786732.pdf
- https://condominiobrisasdelnorte.com/userfiles/file/xuvavesusofufopevogome.pdf
- http://bertrandetgastineaudesigners.fr/userfiles/file/74108639318.pdf
- https://40parables.com/wp-content/plugins/super-forms/uploads/php/files/0a58a78b142cdbd09c5bd967b230d814/widujekuwizipeku.pdf
- http://www.iycadana.org/wp-content/plugins/super-forms/uploads/php/files/gcd7ob803hk9qes1stot3c7805/85014210374.pdf
- https://cedarcreeksauce.com/wp-content/plugins/super-forms/uploads/php/files/46857d3ef96bbd13b9790f3267317121/sokowuderovigufifi.pdf
- http://minhledtran.com/luutru/files/vaniw.pdf
- https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/17e9b7404103bd1ead11f841d4f2cb84/vitivuninoviwor.pdf
- https://www.alongsideasia.com/wp-content/plugins/super-forms/uploads/php/files/03dbb01c36c3850919e4a2e438ffd564/25921283259.pdf
- https://www.jemelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b68aa78dfc9---bimaximad.pdf
- https://divorcioconsensual.com.br/wp-content/plugins/super-forms/uploads/php/files/b8318a0d0c27be1ae49d605722bc7747/fuwizefoverarawuvesigu.pdf
- http://thebankcardservices.com/uploads/files/jiwalofaxavuxerov.pdf
- https://signaturetowerpune.com/wp-content/plugins/super-forms/uploads/php/files/ft11ejstjvvh95r0m0hcpojuf4/ginidopiretugigar.pdf
- https://amartzon.store/wp-content/plugins/super-forms/uploads/php/files/78005748e4336c4ecdb5c04317d5ef07/8171613921.pdf
- https://ercrs.org/wp-content/plugins/super-forms/uploads/php/files/4ml6hbufotodc273u78qm8r6km/xewoforulibamilumax.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=dot+product+and+cross+product
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f5d0.bin09cb9f9f38dd3351b3b71cb1ba128efef3f9655b18c943e4607937a1a48c09f6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF5D0 | 10336 bytes |
font_01_sfnt_off00010d3c.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D3C | 16792 bytes |
font_02_sfnt_off0001254e.bina7932834fb468da26c31e0a907a1258d84cefdac8600a8d5ce80c37a0790359c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1254E | 17172 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.