MALICIOUS
136
Risk Score
Machine Learning
- Nyx PDF Classifier suspicious score 0.3710
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://lazav.co.za/XSRYdR1H?utm_term=atlas+world+map+free++pdf PDF link annotation
- https://www.econiwas.com/econiwascontrol/bower_components/ckeditor/kcfinder/upload/files/68672971283.pdfIn PDF document text
- http://papianiarch.it/userfiles/files/dudex.pdfIn PDF document text
- http://www.roosprommenschenckelfoundation.nl/ckfinder/files/files/liwalomujexafozefas.pdfIn PDF document text
- https://sv-fin.ru/wp-content/plugins/super-forms/uploads/php/files/e5da37c639a9f29833540e09a3b746b6/gezalomudukatuvid.pdfIn PDF document text
- http://cyklokomfort.cz/files/kcupload/files/47707422896.pdfIn PDF document text
- http://imcet.org.tr/kcfinder/upload/files/92831566015.pdfIn PDF document text
- https://autodesk-v2.emailingmanager.com/uploads/editor/file/bikojajevog.pdfIn PDF document text
- http://energywork.pl/userfiles/file/jiforijuzosikiku.pdfIn PDF document text
- https://longislandinvestmentadvisors.com/nini/userfiles/file/48979731440.pdfIn PDF document text
- http://jor-agric-aqua.com/user_img/files/sujatejogiviloretimud.pdfIn PDF document text
- http://hoya889.com/upfile/files/20220213020118.pdfIn PDF document text
- http://www.rlktechniek.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1622003b111132---sixofizumibor.pdfIn PDF document text
- http://synerfreight.com/syner_upload/images/files/xudabosa.pdfIn PDF document text
- http://svm.kalistecom.org/img/files/13452731805.pdfIn PDF document text
- https://webmodeli.com/wp-content/plugins/formcraft/file-upload/server/content/files/1620f3cae793ec---41017125566.pdfIn PDF document text
- http://yonseri.org/userfiles/files/30466565767.pdfIn PDF document text
- http://bloemenwinkelindex.nl/images/uploads/pinozepufexenagifogaseloz.pdfIn PDF document text
- http://nationalcoopadvisors.com/userfiles/files/54510192561.pdfIn PDF document text
- http://tesorosdelayer.es/imgs/images/files/gixeresiveti.pdfIn PDF document text
- https://buddhaart.in/userfiles/file/dalajiwufariribugo.pdfIn PDF document text
- http://gearcon-eng.com/file_media/file_image/file/nafutexikam.pdfIn PDF document text
- https://bisnismedsos.com/userfiles/file/wewiforadojuzemaxo.pdfIn PDF document text
- http://nattukoottam.com/userfiles/file/9381250549.pdfIn PDF document text
- http://le-bouquet.be/userfiles/files/fitivuxepani.pdfIn PDF document text
- https://fontini-rozetki.su/kcfinder/upload/files/xuretugoboxi.pdfIn PDF document text
- http://www.fairvalesecondary.co.za/kcfinder/upload/files/samaxijanudiforar.pdfIn PDF document text
- https://arihantgranites.in/wp-content/plugins/super-forms/uploads/php/files/b0f09c2f16df3ee39f09e47b1a111822/rimuzigokemevetawomejugov.pdfIn PDF document text
- https://reha.bg/content/upload/file/78543936836.pdfIn PDF document text
- http://geshome.co.jp/cmsdesigner/kcfinder/upload/files/pifod.pdfIn PDF document text
- https://hacunamatata.ru/wp-content/plugins/super-forms/uploads/php/files/f37e196111214e567c2f4aad0bdb2da5/mebevoniwitogutemojewude.pdfIn PDF document text
- http://millecolori.it/images/file/jusibesarej.pdfIn PDF document text
- http://tsetv.kz/app/webroot/js/kcfinder/upload/files/36232008619.pdfIn PDF document text
- https://istanbulbalbir.com/upload/ckfinder/files/39710640516.pdfIn PDF document text
- http://blpest.com/UserFiles/file/86137499182.pdfIn PDF document text
- http://amkchem.com/upload/files/wezetukokowipogudutazulol.pdfIn PDF document text
- http://lnyuanzong.com/uploads/files/20220220104617.pdfIn PDF document text
- http://greenlasthousing.com/admin/kcfinder/upload/files/80209694800.pdfIn PDF document text
- http://kulukaubandus.ee/files/filemanager/files/11421467927.pdfIn PDF document text
- https://www.ogsb.org/asset/ckeditor/kcfinder/upload/files/33188800048.pdfIn PDF document text
- http://e5tbr.alruaa.com/ckeditor-ckfinder-integration/uploads/files/guzorutatided.pdfIn PDF document text
- http://alseera.com/admin/kcfinder/upload/files/fobesunuxulotobovesasefak.pdfIn PDF document text
- https://gira-rozetki.su/kcfinder/upload/files/60268439470.pdfIn PDF document text
- http://myblindz.com/fck_user_files/file/gokozazupozojub.pdfIn PDF document text
- http://rayer.cn/d/files/lumepiti.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
+3 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00083508.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x83508 | 18156 bytes |
SHA-256: 108713d64afadef96b9818001e91c525dba8c75e07fe9a38bc8f36cd7f0ea4ad |
|||
font_01_sfnt_off00086491.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x86491 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_02_sfnt_off00087bba.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x87BBA | 10528 bytes |
SHA-256: 73228818521e60225ad15ff061500cb67ec9535c446ec6c63324354e82d10a82 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.