MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The sample is identified as malicious by ClamAV and an ML classifier, and exhibits characteristics of a link farm. It contains numerous URLs pointing to other PDF files hosted on compromised websites, suggesting a multi-stage attack or phishing campaign. The presence of external URIs and link farm heuristics indicates an attempt to redirect users to potentially malicious content.
Machine Learning
- Nyx PDF Classifier malicious score 0.5474
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://macautemple.com/userfiles/file/48180335898.pdf In PDF document text
- http://zbraneklapka.cz/ckfinder/userfiles/files/16474392878.pdfIn PDF document text
- https://law.myvzl.com/wp-content/plugins/super-forms/uploads/php/files/hs19ctvc6hn94v8sg9rjhvtaa0/4973467078.pdfIn PDF document text
- https://shinyjewellers.com/wp-content/plugins/super-forms/uploads/php/files/hck5lqur3q9m8m7vck8gjj1alj/marutudukiladuxokozepusu.pdfIn PDF document text
- https://hightechrustremovers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1610369a5c20d1---3681514970.pdfIn PDF document text
- http://grupomarsamo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160edf71fcf8fe---torozepefibiri.pdfIn PDF document text
- https://www.chesapeake-lighting.com/wp-content/plugins/super-forms/uploads/php/files/64d32a6b52ef5491f9e453b2f2bd0dbf/gukobopimadaxetodiborugup.pdfIn PDF document text
- https://aiaciran.org/cache/fck_files/file/15244884776.pdfIn PDF document text
- https://www.enviedecrire.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606fc20a138c0---39920603470.pdfIn PDF document text
- https://www.beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/90d19b33b8b12026df7f94eea1390fe0/94924907303.pdfIn PDF document text
- http://landmanenterprises.com/clients/6/66/660ad4be7ac834282af30b44844c6003/File/poxer.pdfIn PDF document text
- https://eyestech.in/wp-content/plugins/super-forms/uploads/php/files/7em5r6c966chkcb8hen9cusk7t/xudivuzexivof.pdfIn PDF document text
- http://dolphinegypt.net/userfiles/file/75215247818.pdfIn PDF document text
- https://takiminsahada.com/wp-content/plugins/super-forms/uploads/php/files/lb62pgrou5b45v9qaits6tkijq/47114696137.pdfIn PDF document text
- http://bizwd.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a2dcdbd6a38---tanedifibifatodajojirap.pdfIn PDF document text
- http://www.awakohchang.com/image/upload/File/igimuwigedabowuselam.pdfIn PDF document text
- https://ost-fogging.com/upload/files/36835065000.pdfIn PDF document text
- http://springswellness.net/wp-content/plugins/formcraft/file-upload/server/content/files/16083b53d63a2e---vimibemeru.pdfIn PDF document text
- http://mfcwestenkwartier.nl/beta/userfiles/file/zinedajoxeluwep.pdfIn PDF document text
- https://www.diktu.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f2d22a63b1a---ruduzupovu.pdfIn PDF document text
- https://globalazeri.az/wp-content/plugins/super-forms/uploads/php/files/149shbb2027amjsp26pkpa83k6/bawafabobumaburudutize.pdfIn PDF document text
- https://thejinglelab.com/wp-content/plugins/super-forms/uploads/php/files/1vd3420b1iq2dt08h90er39eo2/nipuvigu.pdfIn PDF document text
- http://www.jindatunnel.com/up_files/file/65019751958.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=perimeter+word+problems+worksheets+pdf+with+answersPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eda9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEDA9 | 17056 bytes |
SHA-256: 5e62004aeb02aa0dd08dc744500333cc08f08f010c605bf15bef6175ffe324da |
|||
font_01_sfnt_off00011a2f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11A2F | 11084 bytes |
SHA-256: eb85fa9c87a3aa7d31e15894e177758a372ed16249864bbacf877a83c4771565 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.