MALICIOUS
176
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains numerous links to compromised WordPress sites, indicating a link farm designed to host malicious content. The 'SE_CALLBACK_LURE' heuristic strongly suggests the document's purpose is to trick the user into calling a phone number, a common tactic in tech-support scams and callback phishing. While no scripts were explicitly extracted, the presence of embedded URLs and the ML classifier's high confidence score point towards a malicious intent, likely to facilitate further exploitation or fraud.
Machine Learning
- Nyx PDF Classifier malicious score 0.9358
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.consorcio.edu.pe/wp-content/plugins/formcraft/file-upload/server/content/files/1606f1aced0bfe---29664371304.pdf In PDF document text
- http://dvarenda.ru/upload/file/sexuwovanafemabesoluwog.pdfIn PDF document text
- https://www.peeryhotel.com/wp-content/plugins/super-forms/uploads/php/files/356e6a7df6f1f938733e78fb8adaf082/xolubejef.pdfIn PDF document text
- http://mistral-paints.cz/userfiles/files/78757077031.pdfIn PDF document text
- http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609888d6dabc6---51210814383.pdfIn PDF document text
- https://glass-haus.ru/wp-content/plugins/super-forms/uploads/php/files/f1aafc5c26b18455d5d0b9398446c34f/lufitinixinevanefife.pdfIn PDF document text
- http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/cb206f66f89ae347915abb8e450be055/5411382153.pdfIn PDF document text
- https://go2germany.ru/files/file/93236571807.pdfIn PDF document text
- http://sosnovgeo.ru/userfiles/file/40352633675.pdfIn PDF document text
- http://tasteofruraleurope.eu/upload/File/61190183228.pdfIn PDF document text
- http://nuyewpilot.academy/wp-content/plugins/super-forms/uploads/php/files/5118344a6924b1e6b1d82a44f0048c95/loseluregumokegevesaza.pdfIn PDF document text
- https://bursaceviritercume.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608b6d89f2d41---10631235247.pdfIn PDF document text
- http://cohn-vossen.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607eb0ce1fba1---luvaferurem.pdfIn PDF document text
- https://www.reflectionuk.com/wp-content/plugins/super-forms/uploads/php/files/letbm9qpe95d40pskpcq2epq3t/fapepefekolerelepelozebo.pdfIn PDF document text
- https://angkorphotographyguide.com/userfiles/file/9409553196.pdfIn PDF document text
- http://reversetheclocknow.com/ckfinder/userfiles/files/1481735017.pdfIn PDF document text
- https://kristinanamaste.eu/files/49792395906.pdfIn PDF document text
- https://divorcioconsensual.com.br/wp-content/plugins/super-forms/uploads/php/files/d718b0ac4e0a694057a537d94b5c0106/xubokaxeriji.pdfIn PDF document text
- https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/1607bf2080b412---wobigomekoviwuwatejumajar.pdfIn PDF document text
- http://bulk-supplies.com/userfiles/file/9902746516.pdfIn PDF document text
- http://pension-erlkoenig.de/img/editor/file/dafujiwiwifuvov.pdfIn PDF document text
- http://www.ddd-iasi.ro/wp-content/plugins/formcraft/file-upload/server/content/files/16086d879e05fa---53676847030.pdfIn PDF document text
- https://www.plsok.com/wp-content/plugins/super-forms/uploads/php/files/6fd612eaa1989623526654bb79570bc7/kifadilofofaraxun.pdfIn PDF document text
- https://krimgranit.ru/wp-content/plugins/super-forms/uploads/php/files/fc2991eb9d8c51b86954cb2a0f7c3d42/79784956135.pdfIn PDF document text
- https://2greenchicks.com/wp-content/plugins/super-forms/uploads/php/files/99d946306ef54502c90e3a4adcfdb87b/lubisaluboxinexagop.pdfIn PDF document text
- http://biolabsrl.org/userfiles/files/fijizapu.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=the+meaning+of+adversePDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_002_off0000ec36.bin |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0xEC36 | 19172 bytes |
SHA-256: 0677d635019e7fddbf0bc121dddfe31d2a0d63f48a635b54404966f1fcb0f460 |
|||
font_01_sfnt_off00010cb8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CB8 | 3912 bytes |
SHA-256: 746db982300d36b7330234759b94b3ed7e6accb7bd055361b1e9e643c99604d3 |
|||
font_02_sfnt_off00011bb4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11BB4 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_03_sfnt_off000133cb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x133CB | 10688 bytes |
SHA-256: 273ffe0031162b8a58e805c149910b408beeaf4bce8efe2f271a2da848d13f5e |
|||
font_04_sfnt_off00014be2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14BE2 | 27860 bytes |
SHA-256: 629218284d698a65bb3510eeea1bbba688d5534902eed92a236b42f8ae16f107 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.