MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document contains numerous links to external websites, many of which are hosted on compromised CMS platforms or disposable domains, suggesting a link farm or phishing lure. The presence of a URL with 'utm_term=canon+70d+user+manual' indicates a potential attempt to trick users into downloading malicious content by impersonating a legitimate document. No scripts were extracted, but the heuristic firings strongly suggest a malicious intent to redirect users to potentially harmful sites.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4673
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://allytemp.ru/uplcv?utm_term=canon+70d+user+manual
- https://avukat.dnsaktif.net/upload/files/8739780310.pdf
- https://weblative.com/wp-content/plugins/super-forms/uploads/php/files/arotb52n2kgafhp2va0sjrdnna/31046107126.pdf
- http://debschoen.com/userfiles/file/webazasijozuxizobevoregi.pdf
- http://usateatop.com/_upload/files/gaxileboladi.pdf
- https://levin-dent.ru/wp-content/plugins/super-forms/uploads/php/files/8bc27b16d09fd70c6a00184a2c603a10/29671787811.pdf
- https://www.abandassociates.com/ckfinder/userfiles/files/10123915806.pdf
- https://samiznojmo.cz/wp-content/plugins/super-forms/uploads/php/files/505c88de180509002b1cce8f7da211bf/vixeveriporujojik.pdf
- http://victorylimo1.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b7c02d3019a---13289342582.pdf
- http://g-shocktou.com/user_file/file/14048969532.pdf
- https://12waktu.com/contents/files/93258245129.pdf
- https://telewebmarketing.com/FCKeditor/file/45954353585.pdf
- http://toanthinh.vn/webroot/img/files/pelaleval.pdf
- http://findusafranchise.com/files/files/98971929751.pdf
- http://redactron.com/userfiles/file/29409712557.pdf
- http://pogservice.ru/userfiles/file/bazopitozikeweva.pdf
- https://ever-progress.com/upload/files/49954886457.pdf
- https://cullinanconstruction.com/wp-content/plugins/super-forms/uploads/php/files/4b7n5rni0defq6tinjhofu34f8/nuzuliwewivutafisadixuder.pdf
- http://pibar.tw/uploads/files/202108220531555987.pdf
- http://hevolta.com/upload/file/35874532144.pdf
- http://huile-de-nigelle.info/userfiles/file/kumurejabumujimof.pdf
- http://bertrandetgastineaudesigners.fr/userfiles/file/19665440125.pdf
- http://bydnjl.com/userfiles/files/dizuxegirupope.pdf
- https://bestmiamiturf.com/wp-content/plugins/super-forms/uploads/php/files/05a0658c927ae2c55452fe0e333bf28b/75152490420.pdf
- http://mastrodibaglio.it/userfiles/files/pedibeku.pdf
- https://lrsinc.co/userfiles/file/82241084042.pdf
- https://efnnma.org/files/file/muwoxezewiranati.pdf
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e87a.bin12867339170776300793682c2d4e93bfcd82f675da1d26da78618378f272b596 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE87A | 10520 bytes |
font_01_sfnt_off0001007a.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1007A | 16792 bytes |
font_02_sfnt_off0001188c.bin26a7ac9317115ffb75184f4cc5278915e4d79b891c9fd17ce4126a2f6994eb0a |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1188C | 18520 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.