MALICIOUS
164
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
This PDF file was identified as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It functions as a link farm, containing numerous external URIs pointing to various websites, some of which are hosted on compromised CMS uploads or disposable domains. The presence of a 'download button' heuristic suggests a lure to trick users into clicking these links, potentially leading to phishing or malware.
Machine Learning
- Nyx PDF Classifier malicious score 0.9947
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://queure.ru/uplcv?utm_term=books+our+best+friend+essay+in+150+words
- http://nicolalazzarotto.com/userfiles/files/sefedakomovamaxe.pdf
- https://sumangold.net.vn/wp-content/plugins/super-forms/uploads/php/files/46l3gg89f7v2pem2qe72sf70lg/fijosodasuf.pdf
- https://mrmusicfoundation.org/wp-content/plugins/super-forms/uploads/php/files/ionn2npfr3n0fjtd521kbraps9/puxuzu.pdf
- https://best-turbos.com/wp-content/plugins/super-forms/uploads/php/files/f9880272c3a4283aa2e2e74ed6c92ce8/18497186240.pdf
- https://amartzon.store/wp-content/plugins/super-forms/uploads/php/files/17209cf1173ced5ecf99cb607c7dd49a/93502329478.pdf
- https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/0bd8ba3b1f48a7b8785faef482dc46eb/puvavuzasenuvafojezap.pdf
- http://xn----8sbpvg0afdbe.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/nk0d3qrfn4vmlj81si4ohr0kb6/naforuvidedizeni.pdf
- http://vom-ragnaroek.de/uploads/file/74411162059.pdf
- http://willtorock.com/wp-content/plugins/formcraft/file-upload/server/content/files/160944bfc164cc---50941103766.pdf
- https://gizaviation.com/uploads/files/13968398198.pdf
- https://centar-znr-zop.hr/wp-content/plugins/formcraft/file-upload/server/content/files/16086056f8c179---6652104717.pdf
- http://subventionsbetrug.de/wp-content/plugins/super-forms/uploads/php/files/8t7hos08ds404t30glo3hpv724/49206800320.pdf
- http://bettynblue.com/upload/fck_img/20210517/file/fubuzujavoton.pdf
- https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a625e1ceeb---54830015377.pdf
- https://spazmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c9f5e4956f8---26996854236.pdf
- https://juraganmonyet.com/contents//files/foguvi.pdf
- https://equator-maritime.com/userfiles/file/51468229131.pdf
- https://mikepromedia.com/wp-content/plugins/super-forms/uploads/php/files/01lco0o2381vcivtec86lba131/mozexizalemibudit.pdf
- https://thesmithgrouphouston.com/wp-content/plugins/super-forms/uploads/php/files/d5b0a38188ffcbd10af65d4e6b8fc38c/76966005329.pdf
- http://www.thebetterinsurance.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607ef9d80ceb8---426592966.pdf
- http://soundreaming.org/wp-content/plugins/super-forms/uploads/php/files/5ef8d51bc6ee4522d8608cf3379f79bf/lorazapiraviginitujev.pdf
- http://www.maarsehoveniers.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1608daf9949221---wiburiwobitofedajezepeliz.pdf
- http://xperion.hu/wp-content/plugins/super-forms/uploads/php/files/5630152703b3a40609e45d2c1ff7bff6/53728806923.pdf
- http://bertoniamministrazione.it/bertoni/public/file/46792220247.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f423.bin77dbcb9d1afc6ca4ad7c6b4057123e3de31613f491049526fdbf39c68bcba2a2 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF423 | 11192 bytes |
font_01_sfnt_off00010eb1.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10EB1 | 16792 bytes |
font_02_sfnt_off000126c3.bin5537fc160b0c7acb9d84e8dde68eacb20ef2d7a39b5987ef0605637bc2f9ba17 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x126C3 | 17592 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.