MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious File
The PDF contains a link farm that directs users to multiple compromised websites, each hosting another PDF. This pattern suggests the file is part of a phishing or malware distribution campaign. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment.
Machine Learning
- Nyx PDF Classifier malicious score 0.5438
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://tamtam.com.ua/wp-content/plugins/super-forms/uploads/php/files/e94500fc70db243a56db253f2a2f5b86/dojane.pdf In PDF document text
- http://drinkandshrink.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/16070975795e19---vifizagizabarixutuxi.pdfIn PDF document text
- http://www.maarsehoveniers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160d6bb51d2524---59130081696.pdfIn PDF document text
- https://levin-dent.ru/wp-content/plugins/super-forms/uploads/php/files/6d6a6e2ad3c9a9a17e258b0593a7fe46/3063423950.pdfIn PDF document text
- http://garderoba.sk/images/_file/70843016497.pdfIn PDF document text
- http://jsushibrea.com/uploads/files/zanagelefodusa.pdfIn PDF document text
- https://www.chesapeake-lighting.com/wp-content/plugins/super-forms/uploads/php/files/425386e851ca32696b72f66464a1d7b4/50790506021.pdfIn PDF document text
- http://corporatiegids.nl/uploads/files/64331607314.pdfIn PDF document text
- http://nuyewrecruitment.com/wp-content/plugins/super-forms/uploads/php/files/f772252e434a4d192b59aef7b115a407/vukawatufu.pdfIn PDF document text
- http://nghiencuuykhoa.com/uploads/userfiles/file/74977899203.pdfIn PDF document text
- https://socialacademy.gr/wp-content/plugins/super-forms/uploads/php/files/98e3d5cb6598dda1d48857685489ff5b/3544156243.pdfIn PDF document text
- https://drticket.ir/basefile/drtiketcom/files/55167876534.pdfIn PDF document text
- https://regionalhealthprogramsww.com/images/file/57914073815.pdfIn PDF document text
- http://skpizzasubs.com/uploads/files/232333595.pdfIn PDF document text
- https://loyd.rs/images/file/74456713369.pdfIn PDF document text
- http://www.lentilles-progressives.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160f36fc9b988f---noxagam.pdfIn PDF document text
- https://yogaspotny.com/userfiles/file/2726439965.pdfIn PDF document text
- http://ngpsusa.com/wp-content/plugins/super-forms/uploads/php/files/pf2c5r224bvtph0v5c312ins6f/93646642911.pdfIn PDF document text
- http://www.kissdocs.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160987ace5613b---tefegaketakinusajon.pdfIn PDF document text
- https://unique.global/wp-content/plugins/super-forms/uploads/php/files/a9df1bd6db7c670624bc22ff81771db8/mabuwesaxolanoxu.pdfIn PDF document text
- http://aarogyamedico.com/userfiles/file/xuradizovetebisovawe.pdfIn PDF document text
- http://daegyung.kr/userfiles/file/20210712221516.pdfIn PDF document text
- https://pointvirgule.ca/upload/editor/file/kuwetujogadipofe.pdfIn PDF document text
- https://hotelite.in/userfiles/file/zukadapunu.pdfIn PDF document text
- https://lamaisonducoeur.ca/upload/editor/file/25531468202.pdfIn PDF document text
- http://aliglobshop.com/userfiles/file/duzijasoza.pdfIn PDF document text
- http://e3edu.vn/public/ckfinder/core/connector/php/connector.phppublic/uploadsfiles/35999801493.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/S30rS-6n6vg/uplcv?utm_term=pharmaceutical+organic+chemistry+2+book+pdf+downloadPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e1f8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE1F8 | 11720 bytes |
SHA-256: 4a66be86b9a08c7d88b9f1c88ab1f25dd1fff49780e7e78c6b96816643cc6d13 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.