MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous links, many pointing to compromised WordPress upload directories, indicating a link farm designed to host or redirect to malicious content. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware distribution via these links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9946
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.trimbleexpress.sk/wp-content/plugins/formcraft/file-upload/server/content/files/1609dbcac28d6c---gurar.pdf
- https://hosvagyok.hu/userfiles/file/dulexiraloduz.pdf
- https://www.potterycommercials.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160ad8bb901208---koxid.pdf
- http://hccc252.ca/clients/e/e4/e484b38507f190a955b66748903449e1/File/47603929953.pdf
- https://www.rydalmereprestige.com.au/wp-content/plugins/super-forms/uploads/php/files/q983lff4chfvpg2ta6b8hgg58i/wikoke.pdf
- https://globalclassic.org/wp-content/plugins/super-forms/uploads/php/files/6sv04ub4iako7epfga15s4cq23/bajafa.pdf
- https://adepotcustom.com/UploadFiles/file/20210520050127197.pdf
- http://www.scmphotography.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16096ca0b7e099---54269967416.pdf
- https://greyquotient.com/wp-content/plugins/super-forms/uploads/php/files/a3c77a151c81244e899d688d0df224bf/fezomatatur.pdf
- http://cityhelps.org/clients/6/61/61afa7a028a8e04f14432b0fece6f2b0/File/gixidotewozademejasekuw.pdf
- http://augustaelectricalwork.com/editorData/file/zavatonafuvekiduwesegela.pdf
- http://www.startservis.sk/novy/ckfinder/userfiles/files/81477368552.pdf
- https://agrachoff.ru/wp-content/plugins/super-forms/uploads/php/files/d261e43c5d6ff8da21891a266fe517c5/96942828555.pdf
- http://accurateverdicts.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088b32386086---66393421384.pdf
- https://www.marbelitesa.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1606e6b7fa0fd7---pojufutomaniw.pdf
- https://feriaesotericadeatocha.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a329f4319c4---3407327952.pdf
- http://muszempilla.com/files/file/repodilutigavovofilil.pdf
- http://www.blackhillsdancecentre.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609456e1a2d54---84309565787.pdf
- https://enville.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088da49ccd80---mapurezuwuneb.pdf
- https://inverpalmas.site/aym_image/files/67693240068.pdf
- https://aashianarealty.com/file/75460799066.pdf
- http://www.champcaregivers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607de398ec783---6365293435.pdf
- https://leicht-spb.ru/wp-content/plugins/super-forms/uploads/php/files/dacd6c9afd18b87a41fc2591a6259dcd/jobomiwaneni.pdf
- https://www.mnspineandsport.com/wp-content/plugins/super-forms/uploads/php/files/e9dc40aec1499377cf3b89e72d6f087e/rusalowozowiz.pdf
- http://www.britocunhaadvocacia.com.br/home/wp-content/plugins/formcraft/file-upload/server/content/files/160842b5ba5820---jevoj.pdf
- https://feedproxy.google.com/~r/Uplcv/~3/3vuEKuznOb8/uplcv?utm_term=derivative+as+a+rate+of+change+word+problems
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e11c.bin9dc96b09a792572a7bdef18859c7e69f6e1c95867dd27b85fe7fcb219022c14f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE11C | 11360 bytes |
font_01_sfnt_off0000fb4c.bin60987d17b157d302667a89a9e6be6d2deeaa19e05b1da8c3a594ee29ba977804 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFB4C | 18864 bytes |
font_02_sfnt_off00012dc7.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12DC7 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.