MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It functions as a link farm, with numerous URLs pointing to compromised CMS upload directories. These links likely serve as lures for phishing or to distribute further malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.8473
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://vincityhomes.vn/wp-content/plugins/super-forms/uploads/php/files/aabo5irj5pnl3trpsjk2gn2vcd/10864279587.pdf In PDF document text
- https://rmissio.pl/wp-content/plugins/formcraft/file-upload/server/content/files/1609867c1984d0---22526301974.pdfIn PDF document text
- https://paperland.bg/uploads/file/doduxidekuxisirilel.pdfIn PDF document text
- https://kassa-evotor.ru/wp-content/plugins/super-forms/uploads/php/files/tbrago7ctkgs0iutkt1ur984rj/74600070375.pdfIn PDF document text
- http://chatyzvule.cz/uploads/lugekebi.pdfIn PDF document text
- https://mamadona.ru/ckfinder/userfiles/files/zitowamoxolububagivenuj.pdfIn PDF document text
- http://www.etoiles-recrutement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608adfd9a0888---taregimonurinupinepo.pdfIn PDF document text
- https://natyabio.com/uploadfiles/16706961654.pdfIn PDF document text
- http://www.abcklima.hu//data/editorfile/bizotipe.pdfIn PDF document text
- https://ceilford.org/wp-content/plugins/super-forms/uploads/php/files/62a51c9cdc0738457b28e207efce6ee9/92557151683.pdfIn PDF document text
- http://slp61.com/clients/e/e2/e296dcecfd7d10ffef0cc83fef253c72/File/23713150247.pdfIn PDF document text
- http://splogservice.ru/content/file/xerogam.pdfIn PDF document text
- https://www.marthatrotts.ca/wp-content/plugins/formcraft/file-upload/server/content/files/16089c4d35b856---55254830780.pdfIn PDF document text
- https://www.tonygssoulfood.com/wp-content/plugins/super-forms/uploads/php/files/f5445e740c40ba24e2af19bb9baaf56d/80916654729.pdfIn PDF document text
- https://alyosserspneed.com/userfiles/files/galeli.pdfIn PDF document text
- https://lashmakerpro.it/wp-content/plugins/super-forms/uploads/php/files/57f37e46bmg56rb6mbtul5j171/ribuvasiv.pdfIn PDF document text
- http://freewest.at/pusika.pdfIn PDF document text
- http://www.sevenchurchestour.net/seven/wp-content/plugins/formcraft/file-upload/server/content/files/16072f90794b12---55176545991.pdfIn PDF document text
- https://onhimalayas.com/ckfinder/userfiles/files/54413125264.pdfIn PDF document text
- https://lcd96.ru/wp-content/plugins/super-forms/uploads/php/files/1fabedcf6b728085886d121301624b1b/91663446807.pdfIn PDF document text
- http://studiocinti.eu/userfiles/files/17019544445.pdfIn PDF document text
- https://www.ogblfrontaliers.fr/wp-content/plugins/super-forms/uploads/php/files/er06sus7655gu6suhq2dol9juu/sodogududamomapibugaraw.pdfIn PDF document text
- http://fobosgrunt.ru/files/ckfinder/files/64716538891.pdfIn PDF document text
- http://monticellotownship.org/userfiles/file/46071163042.pdfIn PDF document text
- http://mazurubezpieczenia.pl/zdjecia/fck/file/33080277160.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=can+guinea+pigs+whistlePDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ebf7.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEBF7 | 10528 bytes |
SHA-256: 1d09dc86f675b373e08adf48d1110cbf0cf71550fcf79e7eb2ff5ca5df99bbdb |
|||
font_01_sfnt_off000103fb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x103FB | 17400 bytes |
SHA-256: 7c264c2591e7c5c9580f4ee0d25c896b42f20181e3080c9db8c1538a9e4fda66 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.