MALICIOUS
166
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains numerous links, with a high-confidence heuristic identifying a link farm pointing to compromised WordPress upload storage, likely for phishing or malware distribution. The primary lure URL, 'https://tevav.co.za/XSRYdR1H?utm_term=impossible+friends+quiz+with+answers', is flagged as an SEO redirector, suggesting a deceptive free download or quiz bait. ClamAV detection as 'Pdf.Phishing.Trojan' further supports the malicious classification.
Machine Learning
- Nyx PDF Classifier malicious score 0.6388
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://tevav.co.za/XSRYdR1H?utm_term=impossible+friends+quiz+with+answers PDF link annotation
- https://lmbri.com/WYSIWYGImage/file/xosajutew.pdfIn PDF document text
- https://www.budgetskemaet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/16216759059c9a---pibebaj.pdfIn PDF document text
- http://shangrilatheshow.com/ckfinder/userfiles/files/98551081629.pdfIn PDF document text
- http://xn----7sbbbizu2bxaod.xn--p1ai/userfiles/file/vuziseresazosuxomo.pdfIn PDF document text
- http://am-assets.com/aom/magnolia/userfiles/file/30235308653.pdfIn PDF document text
- https://intimtreningdebrecen.hu/frontend/ck/kcfinder/upload/files/29016099621.pdfIn PDF document text
- http://www.kidnuri.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621d6169b104d---26165698289.pdfIn PDF document text
- http://cerezolorente.com/files/cerezolorente/_repo/file/44973685594.pdfIn PDF document text
- http://bausite.ru/userfiles/files/6312539778.pdfIn PDF document text
- https://e-room.co/userfiles/file/50691572995.pdfIn PDF document text
- https://www.eurosecurimed.com/ckfinder/userfiles/files/sejugemexinibizobemotebup.pdfIn PDF document text
- https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/848406180993583f15182ae55ecc4c96/lutudiwij.pdfIn PDF document text
- http://ruihuitax.com/files/file/nesonemutamabunivixujolib.pdfIn PDF document text
- https://hefcom-hydraulics.com/ckfinder/userfiles/files/48875494282.pdfIn PDF document text
- http://oguzlarotomatiksanziman.com/depo/sayfaresim/file/kaxaxuref.pdfIn PDF document text
- http://alocainghien.com/uploads/userfiles/file/74281543806.pdfIn PDF document text
- https://justtigers.com/cmswithfiles/file/nefumidoluwir.pdfIn PDF document text
- http://pavcargo.ru/wp-content/plugins/super-forms/uploads/php/files/a04485207cb73087c8c98989a6326a05/11869654714.pdfIn PDF document text
- http://brilspa.ro/userfiles/file///40696461338.pdfIn PDF document text
- http://saoz.sk/assets/kcfinder/upload/files/nabesesevu.pdfIn PDF document text
- http://ferrocom-spb.ru/userfiles/files/22634232289.pdfIn PDF document text
- https://aryaayur.com/wp-content/plugins/formcraft/file-upload/server/content/files/1621e58b55f91e---zugadikibo.pdfIn PDF document text
- http://www.pilartangguh.com/file/xifuk.pdfIn PDF document text
- http://theflowermaker.com/uploads/File/jigidifena.pdfIn PDF document text
- https://leicht-spb.ru/wp-content/plugins/super-forms/uploads/php/files/8dba186393ec49d43508e3db4696cc29/11612744033.pdfIn PDF document text
- https://siriusdynamics.com/assets/uploads/files/44656095801.pdfIn PDF document text
- http://brilsports.ro/userfiles/file///34724950757.pdfIn PDF document text
- http://chronoflex-dz.com/app/webroot/assets/js/kcfinder/upload/files/46138265084.pdfIn PDF document text
- http://wellnesszeewolde.nl/site/data/ws/files/xesakirono.pdfIn PDF document text
- http://syscall.com.tr/panel/kcfinder/upload/files/sugusivep.pdfIn PDF document text
- http://dangkykinhdoanhkiengiang.com/upload/ck/files/82082646076.pdfIn PDF document text
- https://torgradio.ru/new/files/file/3735571259.pdfIn PDF document text
- http://emcmotorbikerental.com/asset/kcfinder/upload/files/57246063307.pdfIn PDF document text
- http://lotyzapoznawcze.pl/cms/files/94048490208.pdfIn PDF document text
- http://helenhotel.vn/upload/files/24647956827.pdfIn PDF document text
- https://ceb.lk/assets/js/kcfinder/upload/files/77287524409.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off0004fb49.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off0004fb49.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0004fb49.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4FB49 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_01_sfnt_off00051269.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x51269 | 11248 bytes |
SHA-256: d984b91ee90b7b6b1b75b6dba8fc05d4c5a258fe755550eb0eafbad2b332d2bd |
|||
font_02_sfnt_off00052c29.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x52C29 | 19760 bytes |
SHA-256: 13bf57bf98a603d389ed2facc66f78aef32d7a59c1fee6c639ef747e689b6cc0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.