MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains a link farm pointing to multiple compromised WordPress sites, which in turn host malicious PDF files. This suggests a phishing or malware distribution campaign. The ML classifier and ClamAV detection strongly indicate malicious intent, likely involving the download and execution of further payloads via embedded links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9760
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://yuseigachi.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc92479e45---tabafifakerugokuperipa.pdf
- http://ahchala.com/img/file/51466037474.pdf
- https://www.breastcancerfoundation.in/wp-content/plugins/super-forms/uploads/php/files/d37973d202e2a611c54963400e6e3fbc/63930025838.pdf
- http://learningkey.org/userfiles/84045264186.pdf
- https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/160c28e3d7bb95---gepilozomi.pdf
- http://waterlootour.com/FileData/ckfinder/files/20210610_0FB2443BE67C62A0.pdf
- https://hostsolutions.ro/app/webroot/files/userfiles/files/wikisifimuzozekogiporez.pdf
- http://techhssilverbuffs.com/clients/61416/File/paxazakojexu.pdf
- http://mijneigenlift.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16084738d069c1---91274027882.pdf
- http://dentherapia.hu/files/file/gitotedewana.pdf
- https://aliencosmicexpo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b16f2294908---xatanomesidemikotuxovivil.pdf
- http://verkoop-je-wagen.be/wp-content/plugins/formcraft/file-upload/server/content/files/160a5a54789482---zijulopibosuzonoxawuvoro.pdf
- http://www.idenet.net/wp-content/plugins/formcraft/file-upload/server/content/files/160a6cebb63deb---23635958794.pdf
- https://mavismanagement.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a7f3421a3d7---61374013975.pdf
- http://www.uppld.org/wp-content/plugins/formcraft/file-upload/server/content/files/160a59a0890ba1---45885472077.pdf
- https://makemycake.gr/wp-content/plugins/super-forms/uploads/php/files/aqicnathr1509ppn080b91vp7a/42934191077.pdf
- https://tortugafilms.ca/adminfiles/file/zuditibibutatupifofowav.pdf
- https://spazmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609444d766da5---komafuwinetowadunanogusom.pdf
- https://zweiund40.com/wp-content/plugins/super-forms/uploads/php/files/2uah5da9vq8on2q0a8vegd98a1/45224118237.pdf
- http://computer-rudolstadt.de/upload/file/5061129810.pdf
- http://www.etoiles-recrutement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607faf87b2601---vafezozagufajorem.pdf
- http://kaufdeinauto.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a3900891fdd---suvetibajeduwezifu.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/DOqCt-cVA4I/uplcv?utm_term=any+man+of+mine+line+dance+step+sheet
- http://lovewhereyoulv.wpengine.com/wp-content/plugins/super-forms/uploads/php/files/8cb038e80eb6ee1ef6d8ceb281c725d9/6568497062.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00051bfd.bin875759ffd1a75b9e38eb75be89fff16894554a69fd828d57011e313c7af0eebf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x51BFD | 19484 bytes |
font_01_sfnt_off00054dfb.bin8076f31695501d474ee36c51ad2dba178963102840abddb0de50e65b9e7bc852 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x54DFB | 10880 bytes |
font_02_sfnt_off000566f7.bin7d15b2d6d265aaca51dda18faee70a1b8fa9d95ed54cb111fb0895789092f9ae |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x566F7 | 16312 bytes |
font_03_sfnt_off00057d02.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x57D02 | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.