MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains embedded JavaScript, which is a common technique for executing malicious code. Multiple heuristics indicate the PDF acts as a link farm, directing users to various compromised or disposable hosting sites. ClamAV detection confirms the malicious nature, identifying it as a phishing trojan.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3113
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://scandirent-new.ru/uploads/assets/file/53078430726.pdf In PDF document text
- https://xlux.vn/wp-content/plugins/super-forms/uploads/php/files/6r277ckapl820hkkd09dkrkqfa/55408437266.pdfIn PDF document text
- http://artside.org/data/temp/file/xatuguwamurebopupoxe.pdfIn PDF document text
- https://hotel-la-licorne.fr/userfiles/file/76341940183.pdfIn PDF document text
- https://educationindiajournal.org/ckfinder/userfiles/files/43920309315.pdfIn PDF document text
- https://christembassybarking.org/wp-content/plugins/super-forms/uploads/php/files/e713dc088091696feae2ec57f7077b4d/9508180857.pdfIn PDF document text
- https://snqrsl.quebec/upload/editor/file/tawinuboluredusumunar.pdfIn PDF document text
- http://tubietelbar.hu/uploadfile/80851967846.pdfIn PDF document text
- https://www.lightingdynamics.com/wp-content/plugins/super-forms/uploads/php/files/dc8cfbb0f83820c3ac4800036f4eaf13/tapeduzogopadug.pdfIn PDF document text
- http://www.movingintofreedom.com/wp-content/plugins/formcraft/file-upload/server/content/files/16099fd6d41f23---6591111997.pdfIn PDF document text
- http://prunay-en-yvelines.fr/ckfinder/userfiles/files/zilixoxizonipe.pdfIn PDF document text
- https://ehblending.com/wp-content/plugins/super-forms/uploads/php/files/dd47d8904091c37acf4c6e0944d51844/1049604627.pdfIn PDF document text
- https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095b88108a43---wakokilokakuluzoruf.pdfIn PDF document text
- https://theemperorsoldclothes.co.uk/wp-content/plugins/super-forms/uploads/php/files/682v7qngp86jenrg549vrbul3h/12540241467.pdfIn PDF document text
- http://sskj.pl/userfiles/file/worapurikozavelusuxuserur.pdfIn PDF document text
- http://qtjdb.com/UploadFile/2021/07/08/file/20210708_044536_128.pdfIn PDF document text
- http://hyundaihungthinh.com/uploads/images/files/34649256471.pdfIn PDF document text
- https://forumhotel.by/wp-content/plugins/super-forms/uploads/php/files/1j8put3for38gijutgpnbc4ht3/dukosatutunavuvipu.pdfIn PDF document text
- http://andreaslasnik.com/data/files/67094692405.pdfIn PDF document text
- https://flylights.pl/wp-content/plugins/super-forms/uploads/php/files/qgla9ltkgpuhueveto0c4r6ac1/23786705689.pdfIn PDF document text
- http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160a59a06e683c---vizudidepinav.pdfIn PDF document text
- http://binhchuachay.info/Images_upload/files/talokaro.pdfIn PDF document text
- http://jiendurancecoaching.com/ckfinder/userfiles/files/701510166.pdfIn PDF document text
- http://www.phsdcenter.com/temp/js/ckfinder/userfiles/files/porisogag.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/FevRqgeaUVY/uplcv?utm_term=major+pentatonic+scale+chart+pdfPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010ceb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10CEB | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00012502.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12502 | 10840 bytes |
SHA-256: ad91f7e33b085ff4c517e1bc1cc31dd8e9238ba81137ec32bc38c304af252edc |
|||
font_02_sfnt_off00013de3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13DE3 | 18384 bytes |
SHA-256: dd76bbefa4f5ebb0fb814e3e4b70e47181533d6a6815b44acff78be2a2c1e21e |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.