MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains numerous links pointing to compromised CMS uploads and disposable hosting, suggesting it functions as a link farm to distribute malicious content or phish for information. The presence of external URIs and the nature of the links strongly suggest it is part of a phishing or malware distribution campaign, likely delivered as a spearphishing attachment.
Machine Learning
- Nyx PDF Classifier malicious score 0.7998
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://garglob.ru/uplcv?utm_term=wr3d+wwe+2k19+mod+download+apk+free+download+by+mike PDF link annotation
- https://cashofferoregon.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607214be3fd13---30074389008.pdfIn PDF document text
- https://nhatngudongkinh.com/upload/ckupload/files/wevozofanoraj.pdfIn PDF document text
- https://www.ogblfrontaliers.fr/wp-content/plugins/super-forms/uploads/php/files/b9v7r22jt7k3vekuq3qbmpnbud/leziwizobesizapulex.pdfIn PDF document text
- http://flagrant-desir.com/userfiles/file/94673699716.pdfIn PDF document text
- https://agenciaboom.com/wp-content/plugins/super-forms/uploads/php/files/nhtiqoj6s2dt32o3abjjv18o37/guwodinixokawifoxos.pdfIn PDF document text
- https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/daa9e40d2f41d1ebee06d896e92e3059/batizoviji.pdfIn PDF document text
- https://alphacleanwashing.com/wp-content/plugins/super-forms/uploads/php/files/e1637142a36f02322c8f61408502ad6c/55016886171.pdfIn PDF document text
- https://miruyuta96.ru/admin/ckfinder/userfiles/files/lozunevixukidemazososoge.pdfIn PDF document text
- http://www.gainerwindows.ca/wp-content/plugins/super-forms/uploads/php/files/i8lq6dckofamu51s6b3hal2v00/luzomipulaz.pdfIn PDF document text
- http://miamiwars.pl/wp-content/plugins/super-forms/uploads/php/files/3b4b56d4059c6cf6942436bc99373e8a/rovixafida.pdfIn PDF document text
- https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16099134b44b02---webelepividopigifebuvu.pdfIn PDF document text
- http://www.peplex.it/wp-content/plugins/formcraft/file-upload/server/content/files/160fab8254fbda---82545237485.pdfIn PDF document text
- http://szalkasszorutacskok.hu/app/webroot/files/content/files/lazinulajebozewiwatebixa.pdfIn PDF document text
- https://vvpta-irvine.org/userfiles/file/86075642541.pdfIn PDF document text
- https://www.scilights.com/wp-content/plugins/super-forms/uploads/php/files/b0d93d9f3cee66896019c7a41f7ed023/rufebesejaze.pdfIn PDF document text
- http://campbellelectronics.com/uploads/16261433671.pdfIn PDF document text
- https://simovi.mx/wp-content/plugins/formcraft/file-upload/server/content/files/160acad5364006---kujutilu.pdfIn PDF document text
- https://realimpacto.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608eacc037ec5---wejaputodir.pdfIn PDF document text
- https://kvartira-zalog.ru/wp-content/plugins/super-forms/uploads/php/files/46133161d837ed4e1dfa1811a6b37f84/17584019104.pdfIn PDF document text
- https://gauravkankariya.com/wp-content/plugins/super-forms/uploads/php/files/0lmf5bhvkkqd0n0nlhq99ssr15/fepaxodowobi.pdfIn PDF document text
- https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cda1eab2767---76126743889.pdfIn PDF document text
- https://mannerfeltdesignteam.se/ckfinder/userfiles/files/vavogajabukarurokesitele.pdfIn PDF document text
- https://himanshikitchen.info/viking1/uploads/files/lavuzifofulof.pdfIn PDF document text
- http://crm333.com/documentos/file/koxefivikoluwuwupes.pdfIn PDF document text
- https://renesens21.com/ressources/upload/files/21875037136.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00012217.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12217 | 11332 bytes |
SHA-256: d1652dd1cf6aee1a5f0eab8b999a9e8cd76981b6805a90403f1321d0206bc656 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.