MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It functions as a link farm, containing numerous URLs pointing to compromised WordPress sites and other disposable hosting, likely to distribute phishing content or second-stage malware. The presence of external URI heuristics and link farm indicators strongly suggests a phishing or malware distribution campaign.
Machine Learning
- Nyx PDF Classifier malicious score 0.9949
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://pixomot.ru/uplcv?utm_term=solve+for+the+roots+by+completing+the+square PDF link annotation
- https://themodernla.com/wp-content/plugins/super-forms/uploads/php/files/09d322d713f82c702154b0533479b966/xeguduwukuwife.pdfIn PDF document text
- http://www.cascinasorigherio.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a9ba2a88ef2---lituri.pdfIn PDF document text
- http://ptk-astana.kz/wp-content/plugins/super-forms/uploads/php/files/aeaa4bb3b9f6718a8c1b733c4164d85c/50897104544.pdfIn PDF document text
- http://mesotects.com/wp-content/plugins/formcraft/file-upload/server/content/files/160aad74bb55d9---96944676823.pdfIn PDF document text
- https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/36d3aa72a89779e2b5ae531d4edc96a0/rerujub.pdfIn PDF document text
- https://alfa-clining.ru/wp-content/plugins/super-forms/uploads/php/files/84e4cd52b85339305dfe8002e21e100a/nuvamuj.pdfIn PDF document text
- https://activepymes.com/pub/file/difure.pdfIn PDF document text
- https://robotics-institute.com/wp-content/plugins/super-forms/uploads/php/files/av0es1gt8go18v56s4ad06160s/jijobeketemupifisujif.pdfIn PDF document text
- http://aksaaydinlatma.com/img/editor/image/file/woxozazitirewirawumivuruv.pdfIn PDF document text
- https://michaels-limo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16087abddbf732---36838877712.pdfIn PDF document text
- http://www.patricktennis.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160b82ebc8cc78---mepasigunoras.pdfIn PDF document text
- http://a1-automotivegroup.com/upload/files/fepeg.pdfIn PDF document text
- http://svatba-emi.com/uploads/pages/files/93278735436.pdfIn PDF document text
- https://sirikulsteel.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a06a64b87b0---84854837009.pdfIn PDF document text
- https://taichielite.com/louis/taichi/ckfinder/userfiles/files/zuxejepufibikopi.pdfIn PDF document text
- https://www.federatedlighting.com/wp-content/plugins/super-forms/uploads/php/files/7fbbff0b0023b96c7637ae813187ff4c/redomogutivamujanutud.pdfIn PDF document text
- https://www.18fire.com/wp-content/plugins/super-forms/uploads/php/files/d1a4a857c79e4aba51b6df50007786ce/tuzojesewexiwe.pdfIn PDF document text
- http://uro-medical.pl/zdjecia/fotki/file/xupabuxedot.pdfIn PDF document text
- http://www.bewegeninarnhem.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160803c23d16d0---ledoxiru.pdfIn PDF document text
- http://msslink.ru/userfiles/files/pifuwuvukajamonixozaz.pdfIn PDF document text
- http://nuyewrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/9794ed1075301991954fcf6c95ea3945/96050298181.pdfIn PDF document text
- http://lawngo.net/fckfiles/linejasesasagaji.pdfIn PDF document text
- https://hmjrgoldhockey.org/wp-content/plugins/super-forms/uploads/php/files/456c07cc36e4c76025670bd809789abf/94658412409.pdfIn PDF document text
- https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/b7769ca09a20cdc7020d5652c8577277/16789215124.pdfIn PDF document text
- https://christembassyromford.org/wp-content/plugins/super-forms/uploads/php/files/e1c6cd7af18c5b7981b4f7e2bc50788b/32091127049.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ca84.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xCA84 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off0000e296.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE296 | 17276 bytes |
SHA-256: a10e5bb547a4729258f0c1399f98e570281779471fd523294721d903a51721f0 |
|||
font_02_sfnt_off00011019.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11019 | 11568 bytes |
SHA-256: 41551a25d382b47024d48bab8de7a4b28dba435cef88b1d99110f86b1af5909a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.