MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file is a PDF document identified as malicious by ML classifiers and ClamAV, specifically flagged as Pdf.Phishing.Trojan. It contains numerous embedded URLs, many pointing to compromised CMS uploads or disposable hosting, suggesting a link farm designed to redirect users to malicious sites. While no scripts were explicitly extracted, the nature of the URLs and the heuristic firings indicate a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9985
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.shipsupply.co.mz/wp-content/plugins/formcraft/file-upload/server/content/files/1607638775e5b8---jegobifobidabi.pdf In PDF document text
- https://chocoinmobiliario.com/wp-content/plugins/super-forms/uploads/php/files/697c3f62abeb61b96e926f9ea30a60b0/kupufuxosininixebufuka.pdfIn PDF document text
- https://loan-financial.com/wp-content/plugins/super-forms/uploads/php/files/a817115d3ee7e13519a9e56d056b7efd/33585194979.pdfIn PDF document text
- https://mercedesmazo.es/wp-content/plugins/formcraft/file-upload/server/content/files/1612ece79691b4---bemozelusosujosokalogun.pdfIn PDF document text
- http://aeon-dev.com/uploads/files/202108251548477985.pdfIn PDF document text
- https://blugarden.eu/file/minawe.pdfIn PDF document text
- https://vmkstroi.ru/wp-content/plugins/super-forms/uploads/php/files/1e21882366327fd288bcba05c037271a/26517945656.pdfIn PDF document text
- http://chagatea.ru/wp-content/plugins/super-forms/uploads/php/files/4e1dcd6c24e13606400c73a2557e3874/58518249591.pdfIn PDF document text
- https://frennphotography.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608d006e5f705---5456346870.pdfIn PDF document text
- http://haai.org/upload/file/67016673668.pdfIn PDF document text
- http://german-ex.com/images/blog/file/gorupilerefagifadatope.pdfIn PDF document text
- https://wcdt.co.th/wp-content/plugins/super-forms/uploads/php/files/5kadva4t6kr8sn1h05d8u8mfit/julotuw.pdfIn PDF document text
- http://fbrasil.com/userfiles/file///zapatatofupovanamuku.pdfIn PDF document text
- http://gerocuki.hu/user/file/folirovifavexujajufiwirit.pdfIn PDF document text
- http://xn----7sbqwxdbhblh2h.xn--p1ai/data/file/fujepinarif.pdfIn PDF document text
- http://cngwalk.com/fckeditor/userfiles/image/89867268860.pdfIn PDF document text
- http://healhumanity.foundation/userfiles/file/mukopudog.pdfIn PDF document text
- http://4998horo.gmmwireless.com/contents/files/fasexozeduberodi.pdfIn PDF document text
- https://ecoinkworld.com/wp-content/plugins/super-forms/uploads/php/files/7f4b3c3de064941e628d21c94e8ed0f2/79119764263.pdfIn PDF document text
- https://www.mixedclass.com.au/wp-content/plugins/super-forms/uploads/php/files/q81b35jafdds6n7dfh7t3h47e9/95817138567.pdfIn PDF document text
- http://ieeepes-thailand.org/app/webroot/files/files/kuvonigu.pdfIn PDF document text
- https://mn-lawfirm.com/box/userfiles/file/jomifinukefidu.pdfIn PDF document text
- http://miskolciharsona.hu/pictures/file/virujukixasubawoxikalet.pdfIn PDF document text
- https://gservicepz.com/wp-content/plugins/super-forms/uploads/php/files/ad346315cf22b48ab73829e8e4230670/74670605433.pdfIn PDF document text
- https://humantouchtranslations.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/161079e9476392---zafovig.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/1xuhb7AK25c/uplcv?utm_term=enfoque+cr%C3%ADtico+de+los+modelos+de+contabilidad+social+pdfPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001368d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1368D | 21456 bytes |
SHA-256: b1b69c06e30004ce65e8c8d76842e4e79e542f96a01095208152f633637ec978 |
|||
font_01_sfnt_off00016e69.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x16E69 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_02_sfnt_off00018680.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x18680 | 11212 bytes |
SHA-256: ecc43368687524d5da070479837a0209285f7eae820ce33e245d67cfcae668e7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.