MALICIOUS
176
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF document exhibits characteristics of a callback phishing or tech-support scam, as indicated by the 'SE_CALLBACK_LURE' heuristic. It contains numerous links to external websites, many of which appear to be hosted on compromised WordPress sites, suggesting a link farm or distribution network. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9958
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Callback phishing phone lure medium SE_CALLBACK_LUREDocument asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://www.finestkindcharter.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a1be6bde9a5---64634878015.pdf
- https://thejinglelab.com/wp-content/plugins/super-forms/uploads/php/files/tvhnl19obnkeuauocg7vdblup2/51639994395.pdf
- https://karinbentum.nl/uploads/file/49154713078.pdf
- https://floorco.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/f6555b39232b4b478b9119b20c256dc1/moforuxadodekurivaji.pdf
- http://bjaimama.com/data/upload/2021/05/file/202105231130365307.pdf
- http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078b5b3c86ca---nibopebagibuk.pdf
- https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/1ipv63pk9qtbv9un05bqvmh837/21422109700.pdf
- http://midiabyz.com/wp-content/plugins/super-forms/uploads/php/files/6796d63e8429beb5e3b502a7f1f9780e/63670102881.pdf
- http://skolicka.eu/foto/images/file/vuponepebabepowokewurolo.pdf
- http://guoyangmoju.com/userfiles/files/dudikosemezagewomijupav.pdf
- http://agendatourvietnam.com/hinhanh/file/18917185807.pdf
- http://coimbra.hu/uploads/ckfinder/userfiles/files/4135434579.pdf
- http://lctrading-gmbh.com/ckfinder/userfiles/files/62814463273.pdf
- https://tkquiz.com/userfiles/file/86017784074.pdf
- http://tlproduct.com/userfiles/file/18817471579.pdf
- http://1960whs.com/clients/7/73/73384dfd0d582a2861cf356c55c3c578/File/46905115313.pdf
- http://for-rent-aalst.com/wp-content/plugins/formcraft/file-upload/server/content/files/160887a6b7e0dd---firajakubipaw.pdf
- http://titadoorbinhduong.com/upload/files/6865600925.pdf
- https://www.potterycommercials.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1607edf8cc78aa---nirojufiwizufuz.pdf
- https://dsodrecital.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ad340e470ee---4775671792.pdf
- http://uat.ideadunes.com/projects/ideadunes-portfolio-site/wp-content/plugins/formcraft/file-upload/server/content/files/1609abe513c50d---dijila.pdf
- https://home18.ru/wp-content/plugins/super-forms/uploads/php/files/9920ee51693830e6f03d58318ae3e983/jexobevolidijaxit.pdf
- http://yatros.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b50d6f71599---27428183447.pdf
- https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=lab+safety+multiple+choice+questions
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d28b.bin919c31eedca5e51a87e7ad4919c1412ef4d8a8c8f5302582b52c68e87d154030 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD28B | 16772 bytes |
font_01_sfnt_off0000fd8a.bin30f4e0e4e974b7104822fa91eb8a8d4a491222b5f536f7354b5581b68b2f397c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFD8A | 11104 bytes |
font_02_sfnt_off0001171b.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1171B | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.