MALICIOUS
176
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 User Execution: Malicious File
The PDF file contains a link farm with numerous URLs pointing to other PDF files hosted on compromised websites and disposable domains. This structure is indicative of a phishing or malware distribution campaign, aiming to lure users to malicious content. The ClamAV detection and ML classifier strongly support its malicious nature.
Machine Learning
- Nyx PDF Classifier malicious score 0.9988
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
QR-code redirect lure medium SE_QR_LUREDocument instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://beateromer.com/bilder/file/bejikikisivepivovijimibup.pdf
- http://phuocthuan.vn/images/pic/file/15651260687.pdf
- http://arch-teh.com/pic/userfile/sinonelowogiziwotuxabubep.pdf
- http://lushexperiences.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c40d643b9c---12792430210.pdf
- http://agiusfuneraldirectors.com/files/file/2725239719.pdf
- http://www.dramayaramendes.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1606e76d6c0350---fuvigopuselan.pdf
- http://fabriziocar.it/userfiles/files/budewojepe.pdf
- https://udachi.co.th/wp-content/plugins/super-forms/uploads/php/files/70cl5r1c03qeaue3o6il84q4s8/sofuximoguvedasagud.pdf
- https://lawpropertyconsultants.co.uk/wp-content/plugins/super-forms/uploads/php/files/r3mt91t2frtnk3iq4nnnn81tvl/37160427861.pdf
- https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160ac1fff45645---lebinejokutenaroxekuto.pdf
- http://sculecuacumulator.ro/app/webroot/files/userfiles/files/fedonedejuzadipuvapezi.pdf
- https://www.darrellstuckey.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607881827db2a---mozufekug.pdf
- http://kolaykanal.com/userfiles/files/82189992327.pdf
- http://kimhoatra.com/upload/fckimagesfile/16985457540.pdf
- https://bringem.de/wp-content/plugins/super-forms/uploads/php/files/aaae2d7f941a2537851e8010f76a7ac3/kefiwoxaduzipabuf.pdf
- https://ketgate.eu/wp-content/plugins/super-forms/uploads/php/files/ff095b3c43d683098ea61115d5c96819/likugubuwalejebaraf.pdf
- https://123kozijnofferte.nl/wp-content/plugins/super-forms/uploads/php/files/2frmuafjgmmuam60i83vop7o45/baxitodasegeviw.pdf
- http://stepsforstarlight.com/clients/c/c6/c668404594a1c08d975ab50c7bec58f6/File/24205548784.pdf
- http://dom-nenilovo.ru/wp-content/plugins/super-forms/uploads/php/files/82b89ffb44b711c71a953c606745a2a6/66439099906.pdf
- https://www.acptechnologies.com/wp-content/plugins/formcraft/file-upload/server/content/files/16093d4b7a1fb3---55810866640.pdf
- http://lirealestatelitigator.com/wp-content/plugins/super-forms/uploads/php/files/5ceede4ecc7f24bead755e4378068a83/58020959480.pdf
- https://islandsvefir.is/wp-content/plugins/super-forms/uploads/php/files/sn2j78pqnooo1baokpugq35vcv/22265689817.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/1xuhb7AK25c/uplcv?utm_term=sadlier+vocabulary+workshop+enriched+edition+level+f+unit+6+answers
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000de5e.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDE5E | 16792 bytes |
font_01_sfnt_off0000f670.bin66b5f291223b9cfb4df617045460c2abc5eb0d356631fa90ab202a36097de493 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF670 | 16340 bytes |
font_02_sfnt_off000120b9.bin8c180c2557bb8d50c2ba110620c5bd5ca8cd68096cb40b46063a05f0a069b13d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x120B9 | 11560 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.