MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file was identified as malicious by a ML classifier and ClamAV, flagging it as a phishing trojan. Static analysis revealed it functions as a link farm, containing numerous URLs pointing to compromised WordPress sites. These links likely serve as a distribution mechanism for further malicious content or phishing attempts.
Machine Learning
- Nyx PDF Classifier malicious score 0.8602
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://vickers-electronics.co.uk/wp-content/plugins/super-forms/uploads/php/files/9f6549e0bc13b6e1340db1c9f5f5aa84/vuxekuv.pdf In PDF document text
- https://bizdrive.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160ace3cd72ec0---futavuvejukepimevozone.pdfIn PDF document text
- http://cetinelektrik.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/160773031a0413---28830388458.pdfIn PDF document text
- http://iltorg.ru/upload/file/75832670072.pdfIn PDF document text
- http://sinsg.com/files/fckeditor/file/jumosi.pdfIn PDF document text
- http://totalfinance.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160996c334e47e---14232870199.pdfIn PDF document text
- http://thechitay.com/uploads/userfiles/file/wetemosixaleleteruxenezux.pdfIn PDF document text
- https://www.pennlighting.com/wp-content/plugins/super-forms/uploads/php/files/1f756e115675446095b551766c6906f9/wufesu.pdfIn PDF document text
- https://www.elitelawnsolutions.co.uk/wp-content/plugins/super-forms/uploads/php/files/4nd1r8vllo148b56v66ijagujq/79023541109.pdfIn PDF document text
- https://www.3dreamchurch.com/wp-content/plugins/super-forms/uploads/php/files/a405094d478fcfddfab36897a745b80d/losazipesezowovimag.pdfIn PDF document text
- https://cananalimdar.com/wp-content/plugins/super-forms/uploads/php/files/mltctij832iv0k14f18jonjvpu/20886011434.pdfIn PDF document text
- http://dostavkaturov.ru/files/file/fijexinolefir.pdfIn PDF document text
- http://verdantnorwich.com/clients/3/30/306756bb587dffcd11ca74610d845a16/File/32298520343.pdfIn PDF document text
- http://www.hgbehringer.de/img/files/files/72764367302.pdfIn PDF document text
- http://karinameal.com/imgdish/files/labujaxi.pdfIn PDF document text
- http://tuclubcr.com/campannas/file/defetigolaruguzi.pdfIn PDF document text
- http://sumtinathholidays.com/admin/uploadfiles/file/watanametawixewigiwokexof.pdfIn PDF document text
- http://www.theagentpipeline.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c2156cebf83---tedazivaviruwesonorijaw.pdfIn PDF document text
- http://alternativefitness.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160776d4beb3d5---67235678326.pdfIn PDF document text
- http://logisticsnetworks.net/ckfinder/userfiles/files/ragibasiwoxerufagimowug.pdfIn PDF document text
- http://gt-outillages.fr/ressource/site-image/files/68130217710.pdfIn PDF document text
- http://meandnetworking.com/ckfinder/userfiles/files/73317090565.pdfIn PDF document text
- https://babetravelling.com/ckfinder/userfiles2/files/bubolejerawavalol.pdfIn PDF document text
- https://3dreamstudios.com/wp-content/plugins/super-forms/uploads/php/files/9cf50183982712bcccfe60ff0a20b4fa/86247380244.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/FevRqgeaUVY/uplcv?utm_term=ejercicios+ejemplos+de+pares+ordenados+para+ni%C3%B1osPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e558.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE558 | 10896 bytes |
SHA-256: e951331d13ea2a396ef8d12edc63c17ae0791bec99a6a7cdd6a91c64fc7bd340 |
|||
font_01_sfnt_off0000fe22.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFE22 | 16328 bytes |
SHA-256: af5b5ea6425aa2a7b58cde5296c5651bfdef65b7e6246cd6058563e7792af249 |
|||
font_02_sfnt_off00011474.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11474 | 18896 bytes |
SHA-256: d07cee4dec8241643d96550a344ca67c2280bebf5761fd922807c10602acc4aa |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.