MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The file functions as a link farm, containing numerous URLs that point to compromised WordPress sites and other disposable hosting, likely serving as a distribution point for further malware or phishing content. The presence of multiple distinct hosts and the use of 'utm_term' parameters suggest an attempt to obscure the true destination and potentially leverage SEO tactics for distribution.
Machine Learning
- Nyx PDF Classifier malicious score 0.9955
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://khabul.mn/mmpa/userfiles/files/68430510191.pdf
- https://totalyoumovement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b2139a4cc83---losigizalatozo.pdf
- http://longthinhphat.net/uploads/files/10398914576.pdf
- http://lightofislamonair.org/uploads/files/zugijepopofun.pdf
- http://k-yoga.org/file_upload/spaw_upload/file/20210525043259.pdf
- https://heuresromantiques.com/upload/files/75273705880.pdf
- http://www.kreasoft.mx/wp-content/plugins/formcraft/file-upload/server/content/files/1609bda34007b2---15824926561.pdf
- https://avantkart.com/wp-content/plugins/super-forms/uploads/php/files/c1ov2pp0q2s18m9q7ftj8h82vc/53168585128.pdf
- https://foundryindia.org/userfiles/file/vekajav.pdf
- https://www.grandeprairie.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a73161416bb---95632538094.pdf
- https://ferado.vn/userfiles/file/89662475094.pdf
- https://elitestrategyglobal.com/wp-content/plugins/super-forms/uploads/php/files/e9c42208818d278ecd5a79c1f0caba6f/7184787431.pdf
- https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/42eceba46adcb9b587c295d59ebbabcc/80707266189.pdf
- http://mariopresto.pl/userfiles/file/87456123345.pdf
- https://ontime-taxi.kg/wp-content/plugins/super-forms/uploads/php/files/356d0fe416bedae5d2b566d9130b51bd/72217425251.pdf
- https://vuaship.com/wp-content/plugins/super-forms/uploads/php/files/ufp8ms8l27lj095b9df6t4ffgg/33494183983.pdf
- http://www.hkqi.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e24dbe657e---gakewikudakufawurabofa.pdf
- https://termofriz.rs//files/87534508486.pdf
- http://sieckultury.pl/wp-content/plugins/super-forms/uploads/php/files/58bd7b9e9488e95a0b99e861fceb2005/tuxafenisunil.pdf
- https://heritagelogs.com/wp-content/plugins/super-forms/uploads/php/files/2clgmvhh2o5c48o3lqmf1f2o87/14268184348.pdf
- https://www.beachesbrewing.com/wp-content/plugins/super-forms/uploads/php/files/d3f18aeec7a66168515cc6dc66aaaeaa/52081871304.pdf
- http://stromzeleny.cz/file/2952259941.pdf
- https://sdyh.gr/wp-content/plugins/super-forms/uploads/php/files/rv1035ggena8t6ql1vpqpndqe0/vubotawamize.pdf
- https://www.chartsunlimited.com.ph/wp-content/plugins/formcraft/file-upload/server/content/files/1606cb4d5cafc0---nakezonigomigoga.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/LPIa9PGmDLg/uplcv?utm_term=is+a+nucleus+found+in+a+plant+cell
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e6ff.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE6FF | 16792 bytes |
font_01_sfnt_off0000ff11.bindc0746ff8de27cecfb635a7f715e46ef061d535550c48b43a9888889505581b8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFF11 | 16548 bytes |
font_02_sfnt_off000129d6.bind06a9917a0cc9871a905edeabc62b8800611327117e93db82219ba8bb3f8828c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x129D6 | 10564 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.