MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains numerous embedded URLs, many of which point to compromised or disposable domains, suggesting a link farm designed to redirect users to malicious sites. The ClamAV detection and ML classifier further indicate malicious intent, likely related to phishing or malware delivery. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically highlights the non-clustered link farm nature on disposable hosting.
Machine Learning
- Nyx PDF Classifier malicious score 0.6630
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://tsrmmessina.it/userfiles/files/72483764609.pdf In PDF document text
- http://xahscw.com/userfiles/file/12007200156.pdfIn PDF document text
- http://okwmd.com/upload/fckeditor/file/6793245559.pdfIn PDF document text
- https://auf.vn/wp-content/plugins/super-forms/uploads/php/files/1u6i55h66n06fe6ubthv21a3j7/94878077491.pdfIn PDF document text
- https://www.diktu.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609477a341ce3---92738043735.pdfIn PDF document text
- https://kalyna.ua/sites/default/files/userfiles/file/68247900310.pdfIn PDF document text
- https://www.icslights.com/wp-content/plugins/super-forms/uploads/php/files/d2a39551336416e85384bb276f132343/zudumijovijegoxuwonegobuk.pdfIn PDF document text
- https://deewo.de/wp-content/plugins/formcraft/file-upload/server/content/files/16085c0cdc0d5a---jevakij.pdfIn PDF document text
- https://www.myosiaffiliate.com/199trust/img/file/87763375281.pdfIn PDF document text
- http://adhdesign.de/userContent/files/20210606055744-widimileluzeraji.pdfIn PDF document text
- https://eseninternational.com/uploads/files/govebojosusej.pdfIn PDF document text
- http://suportti.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606ff5a13c50a---90209730579.pdfIn PDF document text
- https://reifenscho.de/wp-content/plugins/formcraft/file-upload/server/content/files/16078f2339c268---jedenov.pdfIn PDF document text
- https://moniimpex.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a6e7e89749e---62951279789.pdfIn PDF document text
- http://driver-jazda.pl/upload/file/94968484922.pdfIn PDF document text
- https://folklorebridge.eu/uploads/pictures/files/16050837258.pdfIn PDF document text
- https://ficsllc.com/wp-content/plugins/super-forms/uploads/php/files/b1taboust6k6kaoe2biqfgj5ff/20134236463.pdfIn PDF document text
- https://www.sesc.com.ua/wp-content/plugins/super-forms/uploads/php/files/gs6dstgrdn9ep3r2d513ecg6p0/dasazovupuzatinimebuka.pdfIn PDF document text
- http://malbreil.com/userfiles/file/31515535745.pdfIn PDF document text
- http://triumphtoday.org/wp-content/plugins/formcraft/file-upload/server/content/files/1609b7aad70427---risewelap.pdfIn PDF document text
- https://arvikabc.com/images/uploadedimages/file/zesekumakonigaje.pdfIn PDF document text
- https://wietsevoermans.nl/ckfinder/userfiles/files/rizitozuriwe.pdfIn PDF document text
- http://www.sg-callenberg.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608295b171c98---gareruselumunozi.pdfIn PDF document text
- https://unique.global/wp-content/plugins/super-forms/uploads/php/files/e6a59262cf46a2df95e07d0d8452fee4/latazotekawuti.pdfIn PDF document text
- https://ludifrance.fr/userfiles/file/49789051751.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=mehndi+designs+front+hand+easyPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ffb4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFB4 | 10696 bytes |
SHA-256: 8b4bc7ebed918af51b5152fba6b9b87493d06b9b3713d75fa28afdc4d18e1325 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.