MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. Numerous URLs were extracted, many pointing to compromised CMS uploads or disposable hosting, suggesting a link farm designed to redirect users to malicious sites. The PDF structure and URL patterns are consistent with phishing or malware distribution campaigns.
Machine Learning
- Nyx PDF Classifier malicious score 0.9846
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://cructi.ru/uplcv?utm_term=tete+a+tete+with PDF link annotation
- http://promador.pl/userfiles/file/sakigofim.pdfIn PDF document text
- http://hotechike.com/files/files/75687644795.pdfIn PDF document text
- https://metroguards.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160865043362d1---lixemamifetid.pdfIn PDF document text
- https://frontiersneurophotonics.org/wp-content/plugins/formcraft/file-upload/server/content/files/1/1608eb81589cb3---86152252094.pdfIn PDF document text
- https://vickers-electronics.co.uk/wp-content/plugins/super-forms/uploads/php/files/27704d5ce84858e76c46a12b875922b5/xugunibonoz.pdfIn PDF document text
- http://sdds.be/userfiles/file/leguna.pdfIn PDF document text
- https://empylean.com/wp-content/plugins/super-forms/uploads/php/files/evhvt57rkc2jdrvcp14hmb86v4/ririposapexarokuniku.pdfIn PDF document text
- https://aquaticlandscape.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad99720dfa6---xupumefaluzuwoz.pdfIn PDF document text
- http://petraifevronii.ru/ckfinder/userfiles/files/45134675879.pdfIn PDF document text
- https://independentmusicleague.com/wp-content/plugins/super-forms/uploads/php/files/74b5ac295072ff37c07fc34a2d5307f2/nesozakumu.pdfIn PDF document text
- https://samsungdvm.net/upload/ckfinder/files/pakoninegawitugati.pdfIn PDF document text
- http://vorne-sitzen.eu/pcms/content/file/38125508888.pdfIn PDF document text
- http://woodwork.pl/ubezpiecz/obrazy/file/74073552370.pdfIn PDF document text
- https://artlabjo.com/userfiles/file/9015320912.pdfIn PDF document text
- http://www.iycadana.org/wp-content/plugins/super-forms/uploads/php/files/qkncft7l6gk94nb8gvv6makba7/30187063152.pdfIn PDF document text
- http://kondicionery-ivanteevka.ru/upload_picture/file/72983200107.pdfIn PDF document text
- https://retentionstudentexperience.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e4b89ba4fa---95664540878.pdfIn PDF document text
- http://allegroescrow.com/wp-content/plugins/formcraft/file-upload/server/content/files/160791695533f1---vowimetilojufop.pdfIn PDF document text
- https://alfa-pechati.ru/wp-content/plugins/super-forms/uploads/php/files/5f6656922e9eb28e9291ab7cd7b5b777/lipumenobinoxe.pdfIn PDF document text
- https://www.a2zmedical.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160aa13635d0d4---gakizukeboma.pdfIn PDF document text
- https://www.eziblank.com/wp-content/plugins/super-forms/uploads/php/files/c1oaatleefjsp6reu58d908u70/gixizam.pdfIn PDF document text
- http://apexhealthnutrition.com/newerac2c/userfiles/file/tegodudebafabenifovej.pdfIn PDF document text
- https://solarconsulting.org/wp-content/plugins/super-forms/uploads/php/files/621d478aa45afc543e2a62f09d60b4b2/75728385940.pdfIn PDF document text
- https://www.qbuildsoftware.com/wp-content/plugins/super-forms/uploads/php/files/f54967d858baa2a0249bbfc62763ddd9/16563071428.pdfIn PDF document text
- https://xn----7sbabak5acz7byau.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/fbe23e81817ea071342408905882766b/56438090933.pdfIn PDF document text
- https://funkydrop.shop/wp-content/plugins/super-forms/uploads/php/files/8315a71de3db766e1b65989aad7411f9/devuzedule.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d350.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD350 | 9716 bytes |
SHA-256: 7765edb3668313914d6fb77c5270e032fa805d5d2b1d4d12b902360b5c08cc62 |
|||
font_01_sfnt_off0000e8ae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE8AE | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_02_sfnt_off000100c0.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100C0 | 18252 bytes |
SHA-256: 8e34d8e2e6c5b2788162db84c44475b723e941d97f1da33ef099f8b501a871aa |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.