MALICIOUS
146
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The sample is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links pointing to compromised WordPress upload storage, suggesting a phishing or malware distribution scheme. The presence of PRC/3D content and external URI references further supports its role as a lure to potentially malicious external sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9952
Heuristics 6
-
PRC/3D content in PDF medium PDF_PRC_3DPDF contains PRC 3D content. PRC/U3D parsers have been a recurring Adobe Reader attack surface; treat as a related parser-exploit indicator rather than a specific CVE match.
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://aliancegroup.su/wp-content/plugins/formcraft/file-upload/server/content/files/1608fb171ad8e8---silogijo.pdf
- http://conwaychristian.org/wp-content/plugins/formcraft/file-upload/server/content/files/160701e0d707b4---taduvifiti.pdf
- http://www.insurancedirectcanada.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608b1f1b238ff---jopujinemuvipo.pdf
- https://readxyz.com/wp-content/plugins/super-forms/uploads/php/files/2b9489f124f6e1d44d21c7241bc4c0f8/fijatetapel.pdf
- http://www.jcca.co.in/wp-content/plugins/formcraft/file-upload/server/content/files/160a78befc2e36---49827200623.pdf
- http://kotolantopeni.cz/file/dafimo.pdf
- https://completecollegestrategies.com/wp-content/plugins/super-forms/uploads/php/files/9de1bed46d196b009f3c7354257f90ec/58596087332.pdf
- https://brokenspoke.com/wp-content/plugins/super-forms/uploads/php/files/c9f4bb74b41f9847b3339d4b75473d26/dutobevuzivotajuxumozeki.pdf
- http://farmaciafici.com/userfiles/files/63563546070.pdf
- https://discoverapartmentsforrent.com/wp-content/plugins/super-forms/uploads/php/files/8e28e71273d7f636dd8a2dd518b3ff16/kugatezafel.pdf
- https://aguiapromocional.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1608332fa0bd6e---kobirupofomek.pdf
- http://metabolit-plus.ru/files/file/35986080490.pdf
- http://kapelski.pl/userfiles/file/65136871587.pdf
- http://elonsummerstorage.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a9cdaf8bdc8---xirejejewisipo.pdf
- http://villaturri.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a565702380c---suvakobaxapamevis.pdf
- http://aaexpansionjoint.com/wp-content/plugins/formcraft/file-upload/server/content/files/160712055ed9fe---lorixitenijerefuwatetera.pdf
- https://anzmrrn.org/wp-content/plugins/formcraft/file-upload/server/content/files/16093d7ab95023---rarawumowelezomozig.pdf
- http://panhongbo.com/ckfinder/userfiles/site_eachfun_com/files/14059688527.pdf
- https://sanipacific.com/attachment/file/napopugoruwadijiziruj.pdf
- http://www.medicalalliedtraining.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b41de335562---vawakikiwekipidolage.pdf
- https://deewo.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608386378c3b8---84488072257.pdf
- http://www.sevenchurchestour.net/seven/wp-content/plugins/formcraft/file-upload/server/content/files/160abf3c789911---pelulujinuledi.pdf
- http://omni-links.com/images/blog//file/fijigonuwozoramo.pdf
- https://feedproxy.google.com/~r/Uplcv/~3/fzgW7-mxBc0/uplcv?utm_term=robert+young+postcolonialism+a+very+short+introduction+pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f0a6.binbe745850a7ed88c7b5b53bf086e0179128b6ee02876ea25ac67d074428bb9dce |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF0A6 | 11532 bytes |
font_01_sfnt_off00010b6c.bina76d8594304fe2a1f39eb3b4dbdb4b67737b56ca2a5a5df14d61e487970c3255 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10B6C | 17876 bytes |
font_02_sfnt_off00013997.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13997 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.