MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links, many pointing to compromised WordPress upload directories, suggesting it's part of a phishing or malware distribution campaign. The presence of external URIs and compromised CMS upload links indicates an attempt to redirect users to malicious content or download further payloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9690
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://drafthe.ru/uplcv?utm_term=approach+almost+any+machine+learning+problem+pdf
- http://tourister.kr/userfiles/file/99204444468.pdf
- http://adabaskimerkezi.com/upload/file/nevaxupabi.pdf
- http://kaitosushisb.com/uploads/files/44731132686.pdf
- https://festivalecolo.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160b073d439d27---71320888675.pdf
- https://www.toptalentusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607dfdd13bdd1---25064722703.pdf
- http://saludocupacionalpso.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/160968afa81b25---domosubu.pdf
- https://www.hit-education.com/wp-content/plugins/super-forms/uploads/php/files/o2piu41sg6vta84jr66fievaok/xoxitadasasepovaberoduki.pdf
- https://www.hagensmarketing.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099be7aebdf7---98027388814.pdf
- https://comfortinnbarrie.com/phpsites/vertical_living/uploads/file/72560163716.pdf
- http://bucketdiaries.com/uploads/files/7370154438.pdf
- https://bbgpiti.com/userfiles/files/febazotir.pdf
- https://pablohernandes.com/wp-content/plugins/super-forms/uploads/php/files/24fdc02d70cacf5391f2b539eeb91c18/34022183140.pdf
- http://kuzfarm.ru/images/file/5658587749.pdf
- http://rethabise.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/160a77689ac817---woterixuj.pdf
- http://signexpowholesale.com/project-new/christianbook/upload_images/file/nigalexonizi.pdf
- http://www.chicagoalphas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e77a9efc43---34092065259.pdf
- https://www.wikiwebagency.it/wp-content/plugins/super-forms/uploads/php/files/ab3cc4425f94ed15db8fa4f9c3fe0896/3072401952.pdf
- http://avandcie-automation.fr/ckfinder/userfiles/files/27825034240.pdf
- http://ibiforstarlight.org/clients/3/3c/3cfcca4e360ca8807b7dd7d6e7cbeae0/File/fewenasojasalodisujivi.pdf
- http://mu-rrrc.com/userfiles/file/gizujiloperivimubomonera.pdf
- https://givemeit.ru/wp-content/plugins/super-forms/uploads/php/files/8596612b1bd8f6a26692f1588043db5b/tudutivizoviwino.pdf
- http://www.garriagricola.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073e7dd157fe---67488352083.pdf
- http://remontnoedelo.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160afc0f1788a6---65117005114.pdf
- http://castrolmintabolt.hu/images/upload/file/3733889174.pdf
- http://learningkey.org/userfiles/bizomodekasugosoxa.pdf
- http://thegreenlegacykeepers.com/clients/e/e8/e8dc17949b7ef813e9937e453902477f/File/kuded.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000442af.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x442AF | 16792 bytes |
font_01_sfnt_off00045ac0.bina671d37c7b3b889284622d243fc9727f378cc914a66da79eb58e164c6b93b0ed |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x45AC0 | 16076 bytes |
font_02_sfnt_off00046fe3.binead4605e7a568961683f5cf0716fb6ce3c3e52157c0671648a93fa25cf2a511b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x46FE3 | 11300 bytes |
font_03_sfnt_off000489e3.bin0a1c590feaf18a9a812dcc67d33e63e17fef0af2f663acee3a6acdf81710517a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x489E3 | 19588 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.