MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a link farm hosted on multiple compromised websites, including WordPress installations. The ClamAV detection 'Pdf.Phishing.Trojan' and the presence of numerous external URIs suggest a phishing or malware distribution attempt. The document body is heavily obfuscated and appears to be generated by wkhtmltopdf, indicating it's not intended for direct user reading but rather as a container for malicious links.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4208
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/gt8so5tsot4isuqocfis9b9g64/28551454393.pdf In PDF document text
- http://kondicionery-elektrostal.ru/upload_picture/file/nurosamijulanuwakod.pdfIn PDF document text
- https://eyetracking.pl/userfiles/file/74221481159.pdfIn PDF document text
- http://hansungidschool.com/userfiles/file/demoletifu.pdfIn PDF document text
- http://www.marjojaspers.nl/ckfinder/userfiles/files/15389639827.pdfIn PDF document text
- http://www.uppld.org/wp-content/plugins/formcraft/file-upload/server/content/files/16072c20585d91---42963089229.pdfIn PDF document text
- https://soudurelausiere.ca/upload/editor/file/48692309948.pdfIn PDF document text
- http://www.moyekolodin.com/files/rodizavagumuropit.pdfIn PDF document text
- http://myagreement.com/UserFiles/file/vepofev.pdfIn PDF document text
- https://anglarill.net/userfiles/file/58958017315.pdfIn PDF document text
- https://pensiuneavlasin.ro/wp-content/plugins/super-forms/uploads/php/files/q7tqtc1i3ilhrdak24emjh9rdo/12750099195.pdfIn PDF document text
- http://nakamurasangyou.jp/app/webroot/uploads/files/32127474374.pdfIn PDF document text
- https://zazilha.com.mx/wp-content/plugins/super-forms/uploads/php/files/f9a75e72079bfcda1a039bc79fa5fd5a/renilazedaxujiwe.pdfIn PDF document text
- https://action-roofing.com/wp-content/plugins/super-forms/uploads/php/files/f51d261522c7b7dac94362a0d062be81/63005896013.pdfIn PDF document text
- http://melly-incendie.fr/img_db/98719135331.pdfIn PDF document text
- https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a76a235b6aa---jibegarinenagaladar.pdfIn PDF document text
- https://www.hintonassociates.com/wp-content/plugins/super-forms/uploads/php/files/2b0ecdeaf80bf465811da783852f1dd4/78795077648.pdfIn PDF document text
- https://luathoanghuy.com/uploads/files/97678012289.pdfIn PDF document text
- http://www.empresasdelimpeza.info/wp-content/plugins/formcraft/file-upload/server/content/files/160a950bae9d30---71503989267.pdfIn PDF document text
- https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c52a8bc388e---bexulegebo.pdfIn PDF document text
- http://gatewayhotelbangkok.com/upfile_hotel/files/49304731094.pdfIn PDF document text
- https://bikinibody.be/wp-content/plugins/super-forms/uploads/php/files/j5p5s3k69fmafc86sk2cc80uoc/32443932045.pdfIn PDF document text
- http://banghetretruc.com/media/ftp/file/galak.pdfIn PDF document text
- https://nowackleverkusen.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608d799d6180d---79168991375.pdfIn PDF document text
- https://celovechurch.org/wp-content/plugins/super-forms/uploads/php/files/705138fd389f6b19e91a559d608e2829/25236061393.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/fzgW7-mxBc0/uplcv?utm_term=merchant+of+venice+icse+workbook+answers+pdf+downloadPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f614.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF614 | 18432 bytes |
SHA-256: a94264bbaa68d42fa0573bddeb89f8f60c930e5311ca1935136ecc073c599c12 |
|||
font_01_sfnt_off00012676.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12676 | 11092 bytes |
SHA-256: eec1e13e4c800355baf4e44ae10583998f54624ab80ff6ac1e5cb0b676b91231 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.