MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains numerous embedded URLs, many of which point to compromised WordPress sites and disposable domains, indicating a link farm designed to lure users to potentially malicious content. The ML classifier and ClamAV detection strongly suggest malicious intent, likely phishing or malware distribution through these links.
Machine Learning
- Nyx PDF Classifier malicious score 0.9975
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://kahounova.cz/userfiles/file/34433346983.pdf
- https://primewestelectrical.com/wp-content/plugins/super-forms/uploads/php/files/2d6c67a1c1b1429542a253947ec8c7ba/wanoj.pdf
- https://thesmithgrouphouston.com/wp-content/plugins/super-forms/uploads/php/files/47b3c55fdfa25cd7a533744e30cc7bab/994208135.pdf
- http://ljhalls.com/wp-content/plugins/super-forms/uploads/php/files/156b2f0a4a5160402e30223d005360b5/sufopi.pdf
- https://siyata.co.il/wp-content/plugins/formcraft/file-upload/server/content/files/16074f8a1bf6ea---rakilazejuzipin.pdf
- https://betonwerkendejonge.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1607a957970f66---pagilavugolulefew.pdf
- https://arzhosting.com/calisma2/files/uploads/xukufobumofa.pdf
- http://ngpsusa.com/wp-content/plugins/super-forms/uploads/php/files/b49h952a2he3mdc7cvudstss25/37458107072.pdf
- https://edukiya.com/wp-content/plugins/super-forms/uploads/php/files/2b7c27811d3eb1fd35f9a66d08095f88/lobatav.pdf
- https://wacee.net/wp-content/plugins/formcraft/file-upload/server/content/files/160b20ea5f23d2---49264139327.pdf
- http://yomamasushitogo.com/uploads/files/nabesegekinuluwomup.pdf
- https://soba05.org/wp-content/plugins/super-forms/uploads/php/files/0437fb3afdb12bb6a6268e0ab9714f3e/24232896189.pdf
- https://www.vedaaz.com/wp-content/plugins/super-forms/uploads/php/files/4da78e17888c32e983e3fb6f31e268d0/12080320553.pdf
- http://archi1919.com/smlclub-files/file/wupijoleravepizof.pdf
- https://www.pferde-fuer-unsere-kinder.de/wp-content/plugins/formcraft/file-upload/server/content/files/1608be6882f934---bobudipirotiz.pdf
- https://grupo-kayros.com/userfiles/file/63407319307.pdf
- https://webmodels.studio/wp-content/plugins/formcraft/file-upload/server/content/files/160adab02732c9---guterobasejuxewufovixuge.pdf
- http://webinaris.org/ckfinder/userfiles/publics/files/kegoju.pdf
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/zMnd8XtcwSM/uplcv?utm_term=numerical+methods+for+engineers+solution+manual+7th+edition
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c35d.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC35D | 16792 bytes |
font_01_sfnt_off0000db6f.bin1d828343d3e882f8bce91854080463de8e0bd97050630e3608f4bca11072df7c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xDB6F | 17156 bytes |
font_02_sfnt_off00010833.binbcf1fedbd2993d49af234f72743e2691ce03e4697eac288737c64e03f9a1c364 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10833 | 1772 bytes |
font_03_sfnt_off0001108f.bin435cbda1c693049423e9d45ba247e7583b95cd0fd6a094451b8b9cb10f14ae98 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1108F | 11052 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.