MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a link farm pointing to numerous distinct hosts, many of which are identified as compromised CMS uploads. The presence of 'utm_term' in one URL suggests a phishing or SEO-based lure. While no scripts were explicitly extracted, the PDF structure and URL patterns are indicative of a phishing attempt designed to redirect users to malicious content, likely for credential harvesting or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9827
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://andreagarciam.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a78c60d732b---tasasumisuvo.pdf In PDF document text
- http://victorylimo1.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078860ad83d9---zijezukad.pdfIn PDF document text
- http://scuderieverdina.it/scuderia/userfiles/file/jaxifix.pdfIn PDF document text
- https://advancedbusiness.co/wp-content/plugins/super-forms/uploads/php/files/e6fd0d75c2379f9e37d370ba9a29ce02/71369564034.pdfIn PDF document text
- https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/160778f2fa15df---rulisofibupivotefivug.pdfIn PDF document text
- https://goldengrowers.com/wp-content/plugins/super-forms/uploads/php/files/9bc4f5e3c5ae5de0cd5fff2ec68b2f4f/fatanonodekabezonesog.pdfIn PDF document text
- http://bmcnx.com/userfiles/file/serinoxajepugixezavija.pdfIn PDF document text
- http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160ace4eead6fb---lovulela.pdfIn PDF document text
- https://hssipm.com/wp-content/plugins/super-forms/uploads/php/files/6b75b24f67bdc67b36adf5185a699581/37411182222.pdfIn PDF document text
- http://www.dj-csnl.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1606d977ec3668---lolexezogofepuladusivorop.pdfIn PDF document text
- https://tocgia247.com/wp-content/plugins/super-forms/uploads/php/files/skv88l9rej0ti204egf9lgmlgv/tukilifeb.pdfIn PDF document text
- http://alituncer.com/userfiles/file/badesab.pdfIn PDF document text
- https://www.jemelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082a9ee49458---27846007450.pdfIn PDF document text
- http://skuplaptop.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1606c8badedab7---99121122437.pdfIn PDF document text
- http://szakkepzosiklos.hu/upload/file/64557272340.pdfIn PDF document text
- https://www.corridar.com/wp-content/plugins/super-forms/uploads/php/files/g3tqrrave9bvlkv2f44b6qfiev/62768255157.pdfIn PDF document text
- https://thesmithgrouphouston.com/wp-content/plugins/super-forms/uploads/php/files/ad9b1b0f83f3d13455bc14383dfd97ce/dekezemixexi.pdfIn PDF document text
- https://enville.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608c63ae4f8a2---2766548833.pdfIn PDF document text
- https://www.capitalroofingct.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e575c0dd91---rokomelekuvinotubu.pdfIn PDF document text
- http://www.unidacardoso.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608154a02cc07---50021053408.pdfIn PDF document text
- https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/ab6428ec7bb65c2dab1decfba2945d87/lumovarowevow.pdfIn PDF document text
- https://gpuhub.net/wp-content/plugins/super-forms/uploads/php/files/qiilrltmvsuv5f099rki5cd6i2/fafaxikuvovalojaropiwomep.pdfIn PDF document text
- http://studiolorenzino.eu/userfiles/files/kipebuzanobesuxizigujisar.pdfIn PDF document text
- https://www.audifonosdoshoydos.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086a9b087898---xovovusimuvixes.pdfIn PDF document text
- https://provisionsinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d90998b580---bibol.pdfIn PDF document text
- https://insights3.com/wp-content/plugins/super-forms/uploads/php/files/14b8682454402320580a8101826c8c66/jedolusuzupe.pdfIn PDF document text
- http://atsrealtyvietnam.com/upload/files/muxapobafasezarunadokadix.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=cry+the+beloved+country+pdf+downloadPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c8a8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC8A8 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off0000e0ba.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE0BA | 16636 bytes |
SHA-256: 35e705ba0abe55cd2c5af83ddb6fda90941c9396153c596c92d88a6a001dba14 |
|||
font_02_sfnt_off00010be6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10BE6 | 10996 bytes |
SHA-256: 5302d1edbc06344bdeefecaeedb2d1be3b736b0493b282b2380904382ea2ed68 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.