MALICIOUS
196
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous links, many hosted on compromised CMS platforms, directing users to download files. The 'SE_SECURITY_BYPASS' heuristic suggests the document may also instruct users to disable security software, further indicating malicious intent. The ML classifier and ClamAV detection strongly support a malicious classification, likely related to phishing or malware distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9932
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Security software disable instruction high SE_SECURITY_BYPASSDocument instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://111-orte.de/testarea/cwsCMSlight/media/files/37244491447.pdf
- http://www.photobreak.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16082a96ecaf6c---60368248122.pdf
- http://schouteninterieurwerk.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16094514705be1---89057242783.pdf
- https://donnasalon.ru/wp-content/plugins/super-forms/uploads/php/files/5399f49dd10a8ddccdf827bbf5246f9f/laxetukarekamasinumepuvi.pdf
- https://www.c2commercial.com/wp-content/plugins/super-forms/uploads/php/files/5dd04bccbb4821ec775a9ecc086e280c/rulitaropokikewi.pdf
- http://lirealestatelitigator.com/wp-content/plugins/super-forms/uploads/php/files/38ceb789317a333dce8696de3ed14443/kevoleme.pdf
- https://studio45.live/wp-content/plugins/super-forms/uploads/php/files/1usu6mk6scl2k9o0p1d16nvclr/jawusipuduwuz.pdf
- http://flygarfield.net/userfiles/file/wixazonidomaf.pdf
- https://www.eziblank.com/wp-content/plugins/super-forms/uploads/php/files/5qg55a6vg2vmjaqla4v0gcvpt0/wotogixakejilajesowaduroz.pdf
- https://www.cfo-search.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a02f338a3a5---tinofinoledajajezure.pdf
- https://qualitycountscleaning.com/wp-content/plugins/super-forms/uploads/php/files/b8cec3d6a2c320a0b3a43b3b34633175/tavabamobesawo.pdf
- http://webscape.co.bw/wp-content/plugins/formcraft/file-upload/server/content/files/160788143c6735---10138263799.pdf
- https://www.davidwoodpersonnel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608f4a0c5469d---47411719193.pdf
- http://asesorialuishervas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c5816d2c0f1---pazufozefogidaninuzinot.pdf
- https://btsmstlucia.com/atomicsteps/upload/userfiles/file/tegenosufifupajun.pdf
- http://www.elsecretodelolivo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608465363b9fe---rakuru.pdf
- https://www.limratechnologies.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b588fbe5af4---tirivakojaxutefa.pdf
- https://gonguyenkhoi.vn/upload/files/92591301981.pdf
- https://ukdirectremovals.com/wp-content/plugins/super-forms/uploads/php/files/007d120266bdacc97af24d622e76493a/44504778763.pdf
- https://www.hediyevideo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608541fddf64a---gukomix.pdf
- https://afd.me.uk/wp-content/plugins/super-forms/uploads/php/files/3keu2cdi41ssjsacnm252b12gk/7697416230.pdf
- https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/160cafec04bac4---7840561060.pdf
- http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160b84ffb986e1---duxugiveretolekudupatar.pdf
- http://paintingservicesonline.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb63c875f6---linarezatodif.pdf
- https://lightingsystemscol.com/wp-content/plugins/super-forms/uploads/php/files/8f81a05e093f91cd2cbcb8bacbca0524/73421047762.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/3vuEKuznOb8/uplcv?utm_term=ets2+android+app+download
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00013ed2.bin23bcfcd13b6123241ea32ae1607c07d69097352e527049d6f067048524830822 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13ED2 | 10440 bytes |
font_01_sfnt_off000156b0.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x156B0 | 16792 bytes |
font_02_sfnt_off00016ec2.bind7a8a89cefe2d96d9593ebc319de6a7dbcad10658270433cbe6b9bc3698c319b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16EC2 | 17696 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.