MALICIOUS
184
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm, many hosted on compromised CMS upload directories, contains embedded JavaScript and uses an image-based lure. Specific URLs and indicators for this sample are listed in the indicators section.
Machine Learning
- Nyx PDF Classifier malicious score 0.9956
Heuristics 8
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LUREPDF has 1 image(s), only 2 text block(s), carries a click-outward action, and is only 72 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://omonetach.pl/foto/ilustracje/file/mivuxufemewux.pdf In PDF document text
- http://knshzj.com/CKEdit/upload/files/zumogavogederawejesixaxi.pdfIn PDF document text
- https://www.fifatravels.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d86b776926---51563896992.pdfIn PDF document text
- https://nam.it/wp-content/plugins/formcraft/file-upload/server/content/files/1607856c437614---kesebunele.pdfIn PDF document text
- http://circuitvietnamcambodge.com/hinhanh/file/6648458157.pdfIn PDF document text
- http://qachs88.com/clients/58271/File/zidekuru.pdfIn PDF document text
- http://unicorn-furnitures.com/d/files/xaxavipelozopon.pdfIn PDF document text
- https://evocative.ru/wp-content/plugins/formcraft/file-upload/server/content/files/1607afd91b087c---44771725723.pdfIn PDF document text
- https://mziagroup.com/wp-content/plugins/super-forms/uploads/php/files/0tnq0i8gnr76u3h23ach1lnahv/4609778190.pdfIn PDF document text
- https://olmitek.by/wp-content/plugins/super-forms/uploads/php/files/eg0v9302dagbhufh828mjllss0/fezaputojuxagu.pdfIn PDF document text
- https://win-win-keiba.site/js/ckfinder/userfiles/files/34608452878.pdfIn PDF document text
- https://kamarkosong.com/contents//files/54750024757.pdfIn PDF document text
- https://iamluno.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a87f219ca5c---resakemibinolegepatibofet.pdfIn PDF document text
- https://unitjaya.com/contents//files/vusamodefif.pdfIn PDF document text
- https://tcufroghouses.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d1978ea4c4e---26675688804.pdfIn PDF document text
- https://www.phoenixdentalacademy.co.uk/wp-content/plugins/super-forms/uploads/php/files/b612b6943664ff2e335400d146fdbe31/40829791048.pdfIn PDF document text
- https://thucphamtruongxanh.com/Upload/files/64518543108.pdfIn PDF document text
- https://www.emmabowman.com/wp-content/plugins/super-forms/uploads/php/files/4136a38b7be85d9bc6ca38e381f8291c/laxuvuxa.pdfIn PDF document text
- https://www.hmgfinance.com/ckfinder/userfiles/files/91959293604.pdfIn PDF document text
- https://triptoboloyfoundation.org/editorsfiles/files/lukeneju.pdfIn PDF document text
- https://harpethvalleypto.org/wp-content/plugins/super-forms/uploads/php/files/963e0d8c8371fcdcc3cc649e00055aa8/76108611142.pdfIn PDF document text
- http://yonezawanet.jp/units/24250/zcycom/files/6045040858.pdfIn PDF document text
- http://ruben.pl/ckfinder/userfiles/files/wunosagug.pdfIn PDF document text
- https://www.guestquesttravelmedia.com/wp-content/plugins/super-forms/uploads/php/files/23seak5bltd94pp1ckd76i423l/tejokitumoxuxidikupon.pdfIn PDF document text
- https://ewt.cz/res/file/8465808195.pdfIn PDF document text
- https://www.autodepotperformancegroup.ca/wp-content/plugins/super-forms/uploads/php/files/ap2v659ml95s7mti85c1ehtcdj/fisokixusilekogad.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/1KS0DP0cxss/uplcv?utm_term=all+about+quantitative+researchPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000bd7c.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xBD7C | 14620 bytes |
SHA-256: e6bfa4beab5fbe65cbe7f27bf4f7721c70af41e2f7a404a40d3e9cdee43a02f9 |
|||
font_01_sfnt_off0000e151.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE151 | 10760 bytes |
SHA-256: 83bfd07ae4519fb56da93abbb90b9fe5bf50c796378018e4810337b4ad0a3817 |
|||
font_02_sfnt_off0000fa17.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA17 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.