MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file is identified as a malicious PDF by ClamAV, and static analysis reveals it functions as a link farm. Numerous URLs are embedded, many pointing to compromised CMS uploads or disposable hosting, suggesting an attempt to obscure the true destination. The presence of PDF_SEO_DISPOSABLE_LINK_FARM and PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM heuristics further supports this, indicating a tactic to distribute malicious content or phishing lures through a network of seemingly unrelated websites.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4208
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://garderoba.sk/images/_file/wixavawefisolawanonuro.pdf In PDF document text
- https://www.tessilgiada.it/wp-content/plugins/formcraft/file-upload/server/content/files/16086c8952905c---goxenegafalewavezenugili.pdfIn PDF document text
- https://www.lowdoc-loans.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1609ac89e68c9a---28419344231.pdfIn PDF document text
- https://koncnc.com/genelresimler/file/xogevijexizopa.pdfIn PDF document text
- http://kingspec.su/wp-content/plugins/super-forms/uploads/php/files/c85qpe9s024jghkmhe5no5o3o9/dejomumexew.pdfIn PDF document text
- https://bomberosdenavarra.com/userfiles_nexo/files/pabagoragibefov.pdfIn PDF document text
- http://slstudio.it/userfiles/files/61720030680.pdfIn PDF document text
- http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a7ef5283f36---nunujerexaxenopufed.pdfIn PDF document text
- http://fszhenjia.com/upfolder/e/files/20210623102334.pdfIn PDF document text
- http://hamdard.com/hamdard/app/webroot/img/ckfinder/userfiles/files/89172187690.pdfIn PDF document text
- http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160c86b2a5d209---618122177.pdfIn PDF document text
- https://funkydrop.shop/wp-content/plugins/super-forms/uploads/php/files/678a9f284425ab9d127614f336d27220/titubesurofujijexi.pdfIn PDF document text
- http://viaterrestre.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16098e8e74e6b5---matiripamil.pdfIn PDF document text
- https://amirep.com/wp-content/plugins/super-forms/uploads/php/files/751b60ff5c0e371ae9b998bb53b39616/wutovilawasukozuzas.pdfIn PDF document text
- https://fullhousetourism.com/UploadFiles/file/20210630020834119.pdfIn PDF document text
- http://www.orhancoskun.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b7b18b28b6f---rapuvi.pdfIn PDF document text
- https://fellowpeo.com/wp-content/plugins/super-forms/uploads/php/files/ce2ea785e587a29e44ca3b28691ccf10/kunarovavobexe.pdfIn PDF document text
- https://brusroom.com/wp-content/plugins/super-forms/uploads/php/files/2332fd77cf225920e08132c6c41a2532/99662297251.pdfIn PDF document text
- https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/160ba70b6b2b5a---tonesoxegadizegozazewo.pdfIn PDF document text
- http://agriturismofattorialucciano.com/ckfinder/userfiles/files/dozovigedifi.pdfIn PDF document text
- https://fundreamz.com/ckfinder/userfiles/files/34518998414.pdfIn PDF document text
- https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/30787bc46307a005ffdfd8e53b265712/395183325.pdfIn PDF document text
- https://www.bouldersudbury.org/wp-content/plugins/formcraft/file-upload/server/content/files/16082df34c5d0d---nusutibunal.pdfIn PDF document text
- https://oiweld.com/wp-content/plugins/super-forms/uploads/php/files/196b286a8ebe6628c4db2ed92b3eec6f/19591579537.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/PmAiG5ZyT-k/uplcv?utm_term=word+to+pdf+free+convertorPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f341.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF341 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00010b53.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B53 | 17812 bytes |
SHA-256: 18cd4ebe8487e054747f2f13ca528b98bee0d0b7f6c9296c2220727ea69a1b71 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.