MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains numerous embedded URLs, many of which point to compromised WordPress sites and disposable hosting, indicating a link farm designed to distribute malicious content or phish users. ClamAV detection as 'Pdf.Phishing.Trojan' further supports its malicious nature. The ML classifier also flagged this PDF with a high probability of being malicious.
Machine Learning
- Nyx PDF Classifier malicious score 0.7775
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://irlanc.ru/uplcv?utm_term=iron+clamp+laboratory+apparatus+drawing PDF link annotation
- https://dixietemporarystorage.com/wp-content/plugins/super-forms/uploads/php/files/a0fbf14ab2d0bf81fc520436adc09780/14230034278.pdfIn PDF document text
- http://ddrwc.net/clients/869849/File/55787873214.pdfIn PDF document text
- http://gibson100.com/clients/870224/File/89001314487.pdfIn PDF document text
- https://ourcampuswindow.com/ckfinder/userfiles/files/sedasutoxabunefon.pdfIn PDF document text
- https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/d1e7f14a349b9f602c1717f8acccd39f/xejawozijosiwexigerike.pdfIn PDF document text
- https://tamtam.com.ua/wp-content/plugins/super-forms/uploads/php/files/343f2b99eb5c0ed8b725402a9b7dfeba/wuxob.pdfIn PDF document text
- https://datatech-int.com/userfiles/file/81503988028.pdfIn PDF document text
- http://nano-vip.com/ckfinder/userfiles/files/lakidilemonidenafovogeda.pdfIn PDF document text
- http://whuntex.ru/userfiles/file/51812842059.pdfIn PDF document text
- http://fiumaradelsossio.it/userfiles/files/57500561015.pdfIn PDF document text
- http://socialbomjesus.org.br/wp-content/plugins/formcraft/file-upload/server/content/files/16080b71762c94---dofexinab.pdfIn PDF document text
- https://vettercycles.ch/userfiles/files/pitimesezemiripif.pdfIn PDF document text
- http://morebricks.com/ckfinder/userfiles/files/8166714160.pdfIn PDF document text
- http://kerrya.com/ckfinder/userfiles/files/kajaga.pdfIn PDF document text
- https://halobysciton.com/wp-content/plugins/formcraft/file-upload/server/content/files/160de2d10be970---sazeseni.pdfIn PDF document text
- https://lea-inc.com/wp-content/plugins/super-forms/uploads/php/files/0a5a27b7237d14be9aff6538e382fc48/supidogiporadorom.pdfIn PDF document text
- https://frontivo.ro/userfiles/file/36661248399.pdfIn PDF document text
- https://daismene.it/file/lexisolajofunileburube.pdfIn PDF document text
- https://xn----8sbaavnccwq4am.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/9086976d59733373aa3e8ab895a0102b/22098360550.pdfIn PDF document text
- https://www.hamburgeriaagricola.com/wp-content/plugins/super-forms/uploads/php/files/ujd8b3f8e4essaoketa0p9rs8f/jasetofew.pdfIn PDF document text
- http://www.expertnutritionadvisor.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f2d8d8a120---77221955191.pdfIn PDF document text
- http://duocmyphamcongty.com/app/webroot/uploads/files/lujeger.pdfIn PDF document text
- http://www.kindytennis.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b9fc219cd28---senegefirada.pdfIn PDF document text
- http://www.training4thefuture.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160c5c259e7414---zubusubevozewa.pdfIn PDF document text
- https://anup.bo/images/files/24188065373.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e8a6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE8A6 | 16868 bytes |
SHA-256: 5e95c63ab80cd64fbf30090d8c2eeffa03d2cf98d7f730594c253671a09b93e4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.