MALICIOUS
216
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The sample is identified as a malicious PDF by ML classifiers and ClamAV, exhibiting characteristics of an advance-fee scam. It contains numerous links to external PDFs, many hosted on compromised WordPress sites or disposable domains, suggesting a phishing or malware distribution attempt. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the heuristics strongly indicate a scam involving lotteries, prizes, or parcel deliveries.
Machine Learning
- Nyx PDF Classifier malicious score 0.9835
Heuristics 8
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LUREDocument contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
-
Clickable URI points to raw IP address medium PDF_URI_IP_LITERALPDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://kantoromega.pl/userfiles/file/xibelatojuv.pdf
- https://laxmigrouppune.com/wp-content/plugins/super-forms/uploads/php/files/df65e60c670a2b0283df1d07ad16561a/parefabaw.pdf
- https://www.msolartop.cz/wp-content/plugins/formcraft/file-upload/server/content/files/160d7cf2471456---24188999921.pdf
- http://irishheritagesociety.net/clients/7/7f/7f3653e4c5d791bf76f28d2bf9929747/File/83628032968.pdf
- http://www.trafikyaren.com/wp-content/plugins/super-forms/uploads/php/files/ssj6222rv5ll4qkmdj4h2u1042/zimup.pdf
- http://xperion.hu/wp-content/plugins/super-forms/uploads/php/files/c884846a29076c34c6d9d898ac71c933/rarizo.pdf
- https://augsburger-dartliga.de/uploads/file/33394180089.pdf
- http://myboydfamily.com/clients/7/7f/7f513a2250c12de81a70a6735749c289/File/11618032456.pdf
- https://areshin.ru/wp-content/plugins/super-forms/uploads/php/files/6324fa20b95c16194e3be3f7ba7d600d/5317854739.pdf
- https://belhasasecurity.com/userfiles/file/wutakapiwina.pdf
- http://www.toeterloeh44.de/files/bazipi.pdf
- https://www.caesarstravel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607e146e613b0---kuxoburebekedono.pdf
- http://www.hcibatiment.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160d6bee50c828---taroxivulepejob.pdf
- http://79.170.40.182/boothtastic.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c9adf92e382---98833168201.pdf
- http://bitite.lv/media/txt/122/file/11973005562.pdf
- http://beckydavidsonhomes.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607d80f0be7b1---59679298067.pdf
- http://meteosputnik.ru/userfiles/file/3276868796.pdf
- https://thejasmineway.net/wp-content/plugins/super-forms/uploads/php/files/addmjdikvsnmcoik22jmm14kqb/76542780214.pdf
- http://protech.com.ng/wp-content/plugins/formcraft/file-upload/server/content/files/16079cd1b9822f---nazejipipatisu.pdf
- https://fortlauderdale-carservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b2a52c4b9c0---23685401372.pdf
- https://glasschneider.koeln/wp-content/plugins/super-forms/uploads/php/files/56ibaqa9tecgvglnsceve786k8/biwepeli.pdf
- https://precisionautoandac.com/wp-content/plugins/super-forms/uploads/php/files/a2c814cb27b983993ed8569c402e641b/musizesisewavi.pdf
- http://syuncyoku.jp/upload/file/42510709633.pdf
- http://english-island.pl/wp-content/plugins/super-forms/uploads/php/files/dj53fn5sb4lg318gpn26g3ruu7/96240382749.pdf
- https://www.yoursurveysurveyors.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160b8509643e89---widaresu.pdf
- http://teaandtiara.ca/clients/c/cf/cffd5a667a547ddf6f7ed7e454f715b7/File/11729475820.pdf
- http://residencecarlofelice.com/userfiles/files/22358269569.pdf
- http://pck.malopolska.pl/wp-content/plugins/super-forms/uploads/php/files/a89ec2c33f676e5b28488fa945cc9763/xenaxunazisadun.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=complete+advanced+second+edition+audio+download
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f810.binb443a9cd4195a3a3050f7ec12731290d6476dc10a40dfdbd207883bcdef4f9f1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF810 | 17788 bytes |
font_01_sfnt_off00012685.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12685 | 16792 bytes |
font_02_sfnt_off00013e9c.bin90a3c3dff6882e44a278283228b6430d1cd9bef5f893438efe2e246b37df1e0e |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13E9C | 10860 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.