MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was flagged as malicious by multiple heuristics and an ML classifier, indicating a phishing attempt. It contains numerous links, many pointing to compromised WordPress upload storage, suggesting it's part of a link farm designed to redirect users to malicious content. No scripts were extracted, but the presence of embedded URLs and the nature of the heuristics strongly suggest a phishing or credential harvesting scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9776
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/b7ffdec52518f4183f72d331f1d2c7f2/61251436849.pdf In PDF document text
- https://www.truesdalepainting.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a22036f1548---30619249113.pdfIn PDF document text
- https://yourlightingbrand.com/wp-content/plugins/super-forms/uploads/php/files/68ff0994610f1172f540d2ff8e7bdda3/murumizu.pdfIn PDF document text
- http://ansing.nl/userfiles/file/vebatisefamaf.pdfIn PDF document text
- https://laughteronlineuniversity.com/images/upload/files/39093775680.pdfIn PDF document text
- https://coluer.ir/documents/file/wukasogutawabokajeze.pdfIn PDF document text
- http://alisawedding.com/upload/users/files/20236936350.pdfIn PDF document text
- http://geodez.com/pliki/file/51008132629.pdfIn PDF document text
- http://dakmoto.cz/obrazky/file/87794276701.pdfIn PDF document text
- http://wintec-samu.hu/uploads/files/38301283403.pdfIn PDF document text
- https://qnzar.com/files/wifokokulifobubabunafa.pdfIn PDF document text
- https://inchirierielicopter.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160abe09d6e653---vivawiko.pdfIn PDF document text
- http://hajnysport.cz/FCK_userfiles/file/vukopala.pdfIn PDF document text
- http://jpmoto.biz/upload_picture/zasunuwetolaboruzax.pdfIn PDF document text
- http://scissortailfarms.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be50b74e98c---dadaw.pdfIn PDF document text
- https://rffsev.ru/wp-content/plugins/super-forms/uploads/php/files/0d7ad74898c7ad5910c5e19d68b79dff/viriluwegudutomelajo.pdfIn PDF document text
- http://www.lbf-cosmetics.com/website/wp-content/plugins/formcraft/file-upload/server/content/files/160eca3006b5a0---75769321739.pdfIn PDF document text
- http://thetsaban3watnuea.com/UserFiles/file/jofus.pdfIn PDF document text
- http://bajajsports.com/userfiles/file/23033151177.pdfIn PDF document text
- https://hafa-verein.de/wp-content/plugins/super-forms/uploads/php/files/a08090858a686f1586ccc9785440f5c0/magavelupogejipuximi.pdfIn PDF document text
- https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160931d45446e1---93253013680.pdfIn PDF document text
- https://alkhairi.co.uk/wp-content/plugins/super-forms/uploads/php/files/10579b01bc9c994e5a01eccd2832dc98/7675045483.pdfIn PDF document text
- http://farmaciafici.com/userfiles/files/42335171124.pdfIn PDF document text
- http://studiomilano.eu/userfiles/files/bosukedakenefetuguguvose.pdfIn PDF document text
- http://graphicon.hu/wp-content/plugins/formcraft/file-upload/server/content/files/1607ef2aab64a0---gokalop.pdfIn PDF document text
- https://rmdschoolandcollege.com/wp-content/plugins/super-forms/uploads/php/files/89c7160ae9db7c0e645bb1fbb322af1a/37365201966.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/LPIa9PGmDLg/uplcv?utm_term=manual+de+instalacion+sistema+ansul+r+102PDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0003067c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3067C | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00031e8e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x31E8E | 21868 bytes |
SHA-256: 7e46789a4f2dc61c179a3ea8c36cd9b60b519d1ea44e52d23d2138c026350e32 |
|||
font_02_sfnt_off000355b5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x355B5 | 10916 bytes |
SHA-256: ae5e81eca580f63315b87e9a72321d65031a4adc453e81d5d431e63069e64390 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.