MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.001 Spearphishing Attachment
This PDF document was flagged by ClamAV as a phishing trojan. It contains a 'clipboard command execution lure', instructing the user to copy and paste commands into a shell, which is a common technique for downloading and executing secondary payloads. The document also hosts numerous links on compromised CMS upload storage and disposable hosting, suggesting a distribution mechanism for malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.9835
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LUREDocument tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.femregenx.co.za/wp-content/plugins/super-forms/uploads/php/files/h2p2c8epkib75pps9kbkpjdta1/32036911328.pdf
- http://beetsom.com/PROGRAM_FCKeditor_UserFiles/file/135381744960e374ace1aa2.pdf
- https://keralatemples.info/ckfinder/userfiles/files/xeketakitukavuxezavotaju.pdf
- http://toonesk.com/upload/lofajixazivut.pdf
- http://adabaskimerkezi.com/upload/file/38377617631.pdf
- http://kfbi.ru/content/file/75047545909.pdf
- http://anhuishangbiao.com/upload_fck/file/2021-6-28/20210628052244413020.pdf
- https://deniz-sogutma.org/img/userfiles/file/vejotofoniwowofavireta.pdf
- http://asesoriagarpe.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a5c62bd46a4---gebevaxarozezodiki.pdf
- https://qualitylightsolutions.com/wp-content/plugins/super-forms/uploads/php/files/85165d5d6940878b37c3dff942f238d7/rerizenu.pdf
- http://www.segurosfacility.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609414d42dedb---liporuj.pdf
- http://www.korayozelguvenlik.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082ddb0813ed---zuvazijifujomenatafi.pdf
- http://ewhamd.net/upFiles/ckeditor/files/meluxofalenowebisumizoloj.pdf
- http://www.segurosfacility.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16072ae3a94575---21383722439.pdf
- http://graviroz.hu/ckfinder/userfiles/files/vofozijazekesazemim.pdf
- https://www.parkgest.ch/wp-content/plugins/formcraft/file-upload/server/content/files/1608687b62c530---mezopusa.pdf
- https://avis-medical.ma/wp-content/plugins/super-forms/uploads/php/files/f067f94875332ced3a2b1dbc2ccdc2cb/jawowemetemujufukox.pdf
- https://pointsourcegroup.com/wp-content/plugins/super-forms/uploads/php/files/6263eac70024a8b2394445fa07eede59/60642912587.pdf
- http://itineraire-consulting.com/ckfinder/userfiles/files/zurifobivimuxemuj.pdf
- https://www.lenoir-elec.com/wp-content/plugins/super-forms/uploads/php/files/a3fa6ud4mkurv55e44ac89c1ih/tatulepo.pdf
- http://slphs66.com/clients/e/e6/e62fa13cff665df70d7481f632b33819/File/18708002927.pdf
- https://www.federatedlighting.com/wp-content/plugins/super-forms/uploads/php/files/d6845a1d864e43929062090f4c1184b6/5171005301.pdf
- http://adveotec.com/img/file/7981785219.pdf
- http://sad-azov.ru/wp-content/plugins/super-forms/uploads/php/files/c6f476decb3ee52565e5cfddcfcc4ec7/totumogegapomilomib.pdf
- http://www.itbaloch.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609830066d1a0---xexel.pdf
- https://relleno-acidohialuronico.com/wp-content/plugins/super-forms/uploads/php/files/63ef920e786fb425c1f8a73441c8efaf/55727661045.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/3vuEKuznOb8/uplcv?utm_term=windows+10+product+key+text+file
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000fa1a.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA1A | 16792 bytes |
font_01_sfnt_off0001122c.bine3259a4453461032667a7a5b2311e13fc63f2303ac4adf91d743c04a012af49f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1122C | 17652 bytes |
font_02_sfnt_off00014097.bin0761f49fb8cabb4f9226b12208cb8bb1a30bb00fa3129b60b0a93eb7ac8f6e15 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14097 | 11112 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.