MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was flagged by multiple heuristics and an ML classifier as malicious, with ClamAV identifying it as a phishing trojan. The document contains a link farm with numerous URLs, many pointing to compromised WordPress sites, suggesting an attempt to redirect users to malicious content. The presence of these links and the overall structure indicate a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9955
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://xn----7sbakif2a3azdub.xn--p1ai/admin/ckfinder/userfiles/files/zinodevagugofel.pdf
- http://xn--80aadq3ae7aa5k.xn--p1ai/upload/file/zegikaxel.pdf
- http://raduzhniy.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b539d5a35c4---43361247763.pdf
- http://amwordpress.org/wp-content/plugins/formcraft/file-upload/server/content/files/1606d456d3ab53---10744913568.pdf
- https://duext.com/wp-content/plugins/super-forms/uploads/php/files/4b2fca74d73668b3fbb51dce6e763a04/ragodoxatarelago.pdf
- https://adbetelparaguay.com/wp-content/plugins/super-forms/uploads/php/files/f2b428d231ee9db7c6703f48c5ac3922/16861915849.pdf
- http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/759e02b09d4dcb19488050c509279c7a/giregubi.pdf
- http://amoy-art.com/Upload/file/gopanogapabigeruxemenib.pdf
- http://kcde.kr/userfiles/file/77190934856.pdf
- http://brighterhealthcare.co.uk/wp-content/plugins/super-forms/uploads/php/files/i3ur7l5g8t1dqafr1f12btnvc8/pawepelikobedu.pdf
- https://pima-alarms.rs/slicice/file/paxeraluru.pdf
- http://lilit-realty.com/wp-content/plugins/super-forms/uploads/php/files/3qh5mb5nbo8euealp3cj7i3ot6/96239193963.pdf
- http://caacoding.net/wp-content/plugins/formcraft/file-upload/server/content/files/160956a3ba6d8a---poloxesobovirazagapopexo.pdf
- http://www.ecvbrass.ch/user/web/file/2343898008.pdf
- http://www.bridalchapel.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608910adb646c---dopekiriwipon.pdf
- http://kuzfarm.ru/images/file/21615210901.pdf
- https://promocionesnma.com/wp-content/plugins/super-forms/uploads/php/files/59eb45e04c96f055a8e97c3df58ff300/wugusaxemisuvumulokezi.pdf
- https://namastehealth.in/wp-content/plugins/super-forms/uploads/php/files/d62bph61h8orpua9pcgm2ijrla/nupotisenusujupumuxegute.pdf
- https://benchmarktransitions.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609fac3ba31d0---bexijuxapujemuz.pdf
- http://aeskulap24h.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c9e190ef3e7---kegapuruximopafukeviz.pdf
- https://uaqbakery.com/wp-content/plugins/formcraft/file-upload/server/content/files/16079ca1d60b56---wozezejisovixa.pdf
- https://www.fifatravels.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c4007356ba3---8956025915.pdf
- http://creaorganization.com/depo/sayfaresim/file/66295763895.pdf
- https://yournew.site/wp-content/plugins/super-forms/uploads/php/files/d23j96gha569iacn7albtt8265/52430225625.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/cv9VXjIrmdE/uplcv?utm_term=infiltration+anesthesia+in+dentistry
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e8d8.bin6044a6298599cb881babe9fb57559d42b52f83e0cc84f62b6f649e1dd62df262 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE8D8 | 10516 bytes |
font_01_sfnt_off000100af.bin84c84b8c32788f040d627a624f164467e6ea85ecc746743951ab0f81ba68a7d7 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100AF | 16660 bytes |
font_02_sfnt_off00012bb4.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12BB4 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.