MALICIOUS
162
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a phishing or trojan payload. It contains numerous links pointing to compromised WordPress sites, suggesting a link farm used to distribute malicious files. The embedded text, though heavily corrupted, contains references to 'skip verification gta 5 mobile', indicating a lure for a game-related download.
Machine Learning
- Nyx PDF Classifier malicious score 0.9745
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://medvor.ru/uplcv?utm_term=skip+verification+gta+5+mobile PDF link annotation
- https://actioncoach.com.my/wp-content/plugins/formcraft/file-upload/server/content/files/16074216183d06---9027256516.pdfIn PDF document text
- https://primewestelectrical.com/wp-content/plugins/super-forms/uploads/php/files/d60d5a7a004632a97bdffdda4d91970b/zevavomafukixukebozufin.pdfIn PDF document text
- https://hotelristorantenovecento.it/wp-content/plugins/super-forms/uploads/php/files/2d790ca19868cb1b02698c977a83d73c/zevetexosipezujulasodi.pdfIn PDF document text
- https://www.napariverinn.com/wp-content/plugins/super-forms/uploads/php/files/8bc64696475d2b78ec2e667c2d264fe4/51297223641.pdfIn PDF document text
- http://ridendo.cz/files/file/56889993889.pdfIn PDF document text
- http://ganan10.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16093ce230dfc7---betujejogiguderiw.pdfIn PDF document text
- https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/u417rjeh2ldte2mvsgmaorgill/buvozasudovasefov.pdfIn PDF document text
- https://fedico.ca/upload/editor/file/katukufazinexavo.pdfIn PDF document text
- https://jamurgoreng.net/contents//files/jegabekuvikumitujelifexa.pdfIn PDF document text
- http://test.uebersetzungen-nesselberger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606c9915765ef---degoxojolumagu.pdfIn PDF document text
- http://vce34.ru/attachments/file/zaganepitupoxufidas.pdfIn PDF document text
- http://kalikraft.com/images/file/33199659830.pdfIn PDF document text
- http://limpiasol.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b25361658a---xasagemazorakevimudofe.pdfIn PDF document text
- http://www.moteco.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160b639c8d3cb7---zarejukomuwowa.pdfIn PDF document text
- https://www.andrecampbell.ca/wp-content/plugins/super-forms/uploads/php/files/2e8fa21f415dc6dbc60592d8bee73758/gidejimolifa.pdfIn PDF document text
- https://www.grecosalesinternational.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b599ec056a8---53366699879.pdfIn PDF document text
- https://www.ndgai.com/wp-content/plugins/super-forms/uploads/php/files/sqc7j1f4lv24scmtdamjsfllqv/32390412527.pdfIn PDF document text
- https://mujeresenmovimientoplus.com/userfiles/file/pubevolufuvopejezenawego.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001324d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1324D | 5648 bytes |
SHA-256: 1e068b0885213fe4f0d9ffdf307ae5115cc6e604a8fd48b43cf88351e33f8548 |
|||
font_01_sfnt_off00014588.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x14588 | 12120 bytes |
SHA-256: bcaa7f30208baef9bf38267700561d1f7e59bb7f853f0b93435b2ecfe4fbb420 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.