MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of embedded URLs, many of which point to compromised WordPress installations. This behavior is indicative of a link farm designed to distribute malicious content or phish users. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment.
Machine Learning
- Nyx PDF Classifier clean score 0.2226
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://saraelv.no/wp-content/plugins/formcraft/file-upload/server/content/files/160ddf5fbb0a7d---61822449901.pdf In PDF document text
- https://proff-doors.ru/wp-content/plugins/super-forms/uploads/php/files/0c2306b097c42efe5f2122fa0ae9ad0f/verunevujos.pdfIn PDF document text
- https://aquariumfargo.com/wp-content/plugins/super-forms/uploads/php/files/426a4fc34b685a696c1b0430957bed5c/16657831414.pdfIn PDF document text
- https://mylin.in/ckeditor/ckfinder/userfiles/files/69097179575.pdfIn PDF document text
- https://esz.jp/img/editor/files/88704534925.pdfIn PDF document text
- https://event-connections.net/wp-content/plugins/formcraft/file-upload/server/content/files/1608afb3409651---71359406022.pdfIn PDF document text
- https://vannordenvastgoed.nl/userfiles/file/movikidubiliraxut.pdfIn PDF document text
- https://www.opdrrustukalac.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ceabd2fcd7---sogagapagopewi.pdfIn PDF document text
- http://aarogyamedico.com/userfiles/file/fowoziwuzapomibiwokip.pdfIn PDF document text
- https://afayl.com/userfiles/file/lubokopozejojilarivafebas.pdfIn PDF document text
- http://mognational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608a299a5bb66---gikefos.pdfIn PDF document text
- http://elskenecologie.nl/files/31474843235.pdfIn PDF document text
- http://normandyclassof79stl.com/clients/e/e1/e16d7b8530e96d8d426d6b963c92b0b5/File/kalunabeti.pdfIn PDF document text
- http://vkts.se/userfiles/file/21203346635.pdfIn PDF document text
- http://dralituncer.net/userfiles/file/71477329686.pdfIn PDF document text
- http://yanartekstil.com/firma/files/rafowebakonod.pdfIn PDF document text
- http://finadev-groupe.com/userfiles/file/fidiwimajakolomamewud.pdfIn PDF document text
- https://spazmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160be6abb676f2---1033367208.pdfIn PDF document text
- https://cald-lighting.com/wp-content/plugins/super-forms/uploads/php/files/6000dd3305ab3894bcfe46cb228eacea/wetuzidigizumomibelep.pdfIn PDF document text
- https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606cddc50ded4---98914239555.pdfIn PDF document text
- https://penzionradvanice.cz/res/file/femowodeta.pdfIn PDF document text
- http://111-orte.com/testarea/cwsCMSlight/media/files/55737867622.pdfIn PDF document text
- https://ihotel2b.com/upfiles/editor/files/6812931906.pdfIn PDF document text
- http://redwoodpwr.com/wp-content/plugins/super-forms/uploads/php/files/tips84f8fh73iufss3784tqbb0/dasapusibuvawivakewipal.pdfIn PDF document text
- http://food-cloud.com/home/food-cloud/www/site/site/data/files/wupejawitifawudelamatuve.pdfIn PDF document text
- http://ngocvietbungalow.com/upload/files/wizakidopemek.pdfIn PDF document text
- https://bonpetsupply.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608defd20c0ec---filudesulo.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=conservative+party+of+canada+platform+2015+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d005.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD005 | 11420 bytes |
SHA-256: 358acb49f4edfbb9ac83adbde2182ee4902c1f715eddb2afd54342043ed9b7f8 |
|||
font_01_sfnt_off0000eb24.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEB24 | 17204 bytes |
SHA-256: 22d4f553d934adcc7ce0f41bd5b7029634dbb64e9a85dcd8f7f336c051d25256 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.