MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection and an ML classifier. It contains a link farm pointing to numerous compromised domains and disposable hosting, suggesting an attempt to redirect users to malicious content. The presence of multiple PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM firings indicates a pattern of using compromised web infrastructure for distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9932
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://nisahanpin.com/calisma2/files/uploads/jadejunes.pdf
- https://www.kasekimi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606fbf0424936---93759007335.pdf
- http://brukbet.com/user_images/file/rewutuzaj.pdf
- https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/160c8fbcbe0d89---99167999534.pdf
- http://bike-aholic.com/UserFiles/file/sorokebamedoji.pdf
- https://too.kg/wp-content/plugins/super-forms/uploads/php/files/ea6f57290d64e4d455282bed9d3151e0/litifonopepenis.pdf
- https://forcechicago.com/wp-content/plugins/super-forms/uploads/php/files/a415163b22ddb931af5186ab8137307c/45904258880.pdf
- https://www.inter-tube.co.uk/wp-content/plugins/super-forms/uploads/php/files/e69b6343be7025040e7651d514d8f0ef/71236381880.pdf
- https://agermag.ro/mm/file/karejixelavebokuv.pdf
- https://realestateconnect.pro/wp-content/plugins/super-forms/uploads/php/files/banelqisdnr7bga4of65u68vl4/79975451560.pdf
- http://villaturri.it/wp-content/plugins/formcraft/file-upload/server/content/files/160973e434a17e---walesifefinup.pdf
- http://thefutureofgolf.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160775d39cb30e---26152986689.pdf
- https://www.freshstartdigitalmarketing.com/wp-content/plugins/super-forms/uploads/php/files/9ac09fa3f51f3b42f2d4e41e560988ba/getexen.pdf
- http://pogservice.ru/userfiles/file/deveru.pdf
- http://wsm.hk/images/uploadfiles/file/27780206427.pdf
- https://www.arc-welding.co.uk/wp-content/plugins/super-forms/uploads/php/files/7hnkpflig09jtnbnrrdjucj6fl/90846040913.pdf
- https://facades-et-traditions.com/actualites/file/fekogerojagitasixavonag.pdf
- https://canvasations.com/wp-content/plugins/super-forms/uploads/php/files/4hrc3cjp6hpvufe1tdonqcc6v7/29779195170.pdf
- https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/54e91685b5b41962dc3aee0701fbcf64/27415649146.pdf
- http://gshosnab.ru/userfiles/file/xilejomun.pdf
- http://www.hydro-tg.pro/upload/file/bimetin.pdf
- https://esteticarcare.com/wp-content/plugins/super-forms/uploads/php/files/3a10b2b66a536396ab676511318ad58d/67437217467.pdf
- http://akinmedical.com/uploads/file/nanobufenobebu.pdf
- http://www.jesuseslaroca.org/wp-content/plugins/formcraft/file-upload/server/content/files/1607a4fae8622d---87702871467.pdf
- https://wscnaturalhealings.com/wp-content/plugins/super-forms/uploads/php/files/7a0b3c9a597cb999dd17180db12c8eaa/14129265955.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/BvfzZFkJO3s/uplcv?utm_term=sequence+meaning+in+telugu
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00014288.binda0b9dd4f3c4df14dae8d01b0caaf884b36e44278341b9753f9fb4447f190974 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14288 | 10508 bytes |
font_01_sfnt_off00015a1a.bin4c96824c3d13bc1682472ae0130d4d26d589dc55eb62931e7cac4e9a3b2fd4d0 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15A1A | 16992 bytes |
font_02_sfnt_off000186b0.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x186B0 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.