MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The file was detected by ClamAV as Pdf.Phishing.Trojan. Static analysis revealed it functions as a link farm, with numerous embedded URLs pointing to potentially compromised websites. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for these links, suggesting an attempt to obscure the true malicious infrastructure.
Machine Learning
- Nyx PDF Classifier suspicious score 0.2676
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://purplebyanki-com.bvirani.com/ckfinder/userfiles/files/30281895600.pdf In PDF document text
- http://benhvienlaptop.biz/userfiles/file/27515123115.pdfIn PDF document text
- https://kovrdom.ru/sites/all/sites/default/files/file/guberopumobuxinovuwitop.pdfIn PDF document text
- http://moveisgarciadigital.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1613750309fc98---18342189202.pdfIn PDF document text
- http://amirmazandaranihospital.com/ckeditor/files/files/70098862888.pdfIn PDF document text
- https://treasurehunterdetectors.com/ckfinder/userfiles/files/lozamozedeboveg.pdfIn PDF document text
- http://devitohomesorlando.com/userfiles/files/kuluxufaxu.pdfIn PDF document text
- https://netiko.fr/img/Data/file/vazetelakogam.pdfIn PDF document text
- https://rdsdealers.com/ckfinder/userfiles/files/pudikananalobinafepa.pdfIn PDF document text
- https://aordonez.com/images/contenidos/files/78620973675.pdfIn PDF document text
- http://csc0512.com/userfiles/file/20210904152031_l3wrtr.pdfIn PDF document text
- http://marketingnews.fr/images/file/10053525869.pdfIn PDF document text
- http://stmarysharipad.com/userfiles/file/samolinasepepagiren.pdfIn PDF document text
- http://workcoop.org/fckeditor/userimages/file/20210906011741.pdfIn PDF document text
- http://matchonusa.com/uploads/files/ruxosuzumujug.pdfIn PDF document text
- http://inspirationallabels.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1613952b78c392---mepuguzewowofime.pdfIn PDF document text
- http://wyadonline.com/userfiles/file/63017554664.pdfIn PDF document text
- http://eot.mn/uploads/userfiles/files/48028672796.pdfIn PDF document text
- https://plentis.eu/ckfinder/userfiles/files/judew.pdfIn PDF document text
- http://inspirationallabels.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1612e9e781b7e3---jawozazisixemijojom.pdfIn PDF document text
- http://erbamedica.org/userfiles/files/rapavumuxomagutosu.pdfIn PDF document text
- https://thebookonpersonaltransformation.com/FCKeditor/file/74311811517.pdfIn PDF document text
- https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1613be6e38124b---49951881411.pdfIn PDF document text
- http://szjg.hu/images/file/10047557642.pdfIn PDF document text
- http://argentum.com/wp-content/plugins/super-forms/uploads/php/files/jt9qk2uciefmhpkj37ki1bm0r4/5812142390.pdfIn PDF document text
- https://seltec.io/images/uploads/files/10596368189.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/PmAiG5ZyT-k/uplcv?utm_term=spanish+translation+app+androidPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eeb8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEEB8 | 17208 bytes |
SHA-256: 10047a4a46928ac6eae3bb194f5930630376ab8adc8dc72f9e29c599cf43a876 |
|||
font_01_sfnt_off00011b56.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11B56 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.