MALICIOUS
204
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document employs a remote-support tool lure, instructing the user to install or connect with such a tool, which is a high-risk activity in unsolicited documents. It also utilizes a link farm hosted on compromised WordPress upload storage, suggesting an attempt to distribute further malicious content or phishing pages.
Machine Learning
- Nyx PDF Classifier malicious score 0.9835
Heuristics 8
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Remote-support tool lure high SE_REMOTE_SUPPORT_LUREDocument instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://arserwood.com/js/fckeditor/editor/filemanager/connectors/php/connector.php/upfiles/file/210503120829139659d3g1ff.pdf In PDF document text
- http://haverfordhigh77.com/clients/e/e7/e7c5a96ea35a64a1345a575153f12e7e/File/57379897930.pdfIn PDF document text
- http://alsumiri.net/wp-content/plugins/super-forms/uploads/php/files/0468efc39b478d16999b853cef22d433/47630055917.pdfIn PDF document text
- http://herodumpsterrental.com/wp-content/plugins/super-forms/uploads/php/files/cc20d6610330fe66f7568a514130165b/78536234024.pdfIn PDF document text
- https://designcoordinators.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073835b27373---16821986860.pdfIn PDF document text
- http://uctodane.cz/UserFiles/File/91074269372.pdfIn PDF document text
- https://sfasg.jp/js/ckfinder/userfiles/files/18747368123.pdfIn PDF document text
- https://www.histoiresdegroupes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c04e9d4621d---86842300592.pdfIn PDF document text
- http://pansophers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3dea763eab---51152212073.pdfIn PDF document text
- https://www.arphplumbing.co.uk/wp-content/plugins/super-forms/uploads/php/files/n0m41003bfe9vtup8k9cuiqqd4/kutoremut.pdfIn PDF document text
- https://envomask.com/wp-content/plugins/super-forms/uploads/php/files/64deef337c6a6613b18c50b32f452561/midapiwinut.pdfIn PDF document text
- http://amwordpress.org/wp-content/plugins/formcraft/file-upload/server/content/files/160b2dd5eba814---73265856167.pdfIn PDF document text
- https://prosperitas.be/data/assets/file/91514822475.pdfIn PDF document text
- https://www.expoagrogto.com/wp-content/plugins/super-forms/uploads/php/files/qbunfu488jdb0ncdnfukkkker6/bamupedipuka.pdfIn PDF document text
- http://zaragozalawoffice.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/10949743825.pdfIn PDF document text
- https://otartufo.com/ckfinder/tartufofiles/files/bazazatiwixafigarux.pdfIn PDF document text
- https://atvatextile.com/upload/ckfinder/files/xozudimudizoxivalifo.pdfIn PDF document text
- http://yorkiematch.com/clients/6/65/653dc45b8f6063886304ac4260dbb99c/File/60622759805.pdfIn PDF document text
- https://www.sevgiliyevideo.net/wp-content/plugins/formcraft/file-upload/server/content/files/16087bc9703bb6---50008753713.pdfIn PDF document text
- http://phantasos.org/userfiles/file/xaxaru.pdfIn PDF document text
- http://sieckultury.pl/wp-content/plugins/super-forms/uploads/php/files/a64f6bc4159f71a0f022efbf7b8e9381/46094078989.pdfIn PDF document text
- https://momsgardenfoods.com/ckfinder/userfiles/files/50997886477.pdfIn PDF document text
- http://lirealestatelitigator.com/wp-content/plugins/super-forms/uploads/php/files/5dbc9a8a4b2ded1e054a1a4cfd1251c6/37279761633.pdfIn PDF document text
- https://spherule.org/wp-content/plugins/super-forms/uploads/php/files/4a188f544294e45c0e6ee0e135ac2f1d/rorumik.pdfIn PDF document text
- http://interwork.sk/userfiles/file/sevepifitut.pdfIn PDF document text
- https://kaptenhoki.net/contents//files/ruronisemazewurar.pdfIn PDF document text
- https://xn-----6kcabagcgfjsxjciriy6alkh6a7aqk.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/373b16f8bf80c61e4046df52a86133b1/bifatelaputafovogotet.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/cv9VXjIrmdE/uplcv?utm_term=king+brinell+hardness+tester+manualPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000edf1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDF1 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00010603.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10603 | 17464 bytes |
SHA-256: 6a8280f2eb6e10295915499f040a42f3111d9964997e6fefb67fc8ec5f4b55d3 |
|||
font_02_sfnt_off00013425.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13425 | 10804 bytes |
SHA-256: 1615a7d9a9046d026a90fc181f253ea155b6d23759ac35c3677f5415d73186d4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.