MALICIOUS
66
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF document contains numerous embedded URLs, many of which point to compromised CMS upload directories. These links appear to form a link farm, a common tactic for SEO poisoning or directing users to malicious content. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' indicates a pattern of using disposable hosting for these links, further suggesting malicious intent.
Machine Learning
- Nyx PDF Classifier clean score 0.1416
Heuristics 5
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://archism.ru/uplcv?utm_term=hot+flashes+in+men PDF link annotation
- http://www.tenniscanberra.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/160a696088965c---39466008029.pdfIn PDF document text
- https://visaonline-vn.com/wp-content/plugins/super-forms/uploads/php/files/t45mvvt8j6bd538u42erqkf5ga/tinitomakobesizevenewega.pdfIn PDF document text
- http://sciencevier.com/wp-content/plugins/formcraft/file-upload/server/content/files/160af86f38440c---60087079560.pdfIn PDF document text
- https://gauravkankariya.com/wp-content/plugins/super-forms/uploads/php/files/s5bqmqds4mohf4ti44qqbfqop5/42574622325.pdfIn PDF document text
- https://mudraconsultancy.com/uploads/files/20798845053.pdfIn PDF document text
- https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/1f9b5df78beaed9cd2b7dbf1b5a64030/53583489760.pdfIn PDF document text
- https://ceadersvalet.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b05df1af1ab---6182776940.pdfIn PDF document text
- https://humantouchtranslations.com/wp-content/plugins/formcraft/file-upload/server/content/files/1/160b9818946fe1---nugubakapanerijaj.pdfIn PDF document text
- https://cualuoihoanmy.com/uploads/userfiles/file/14813471181.pdfIn PDF document text
- https://micast.de/wp-content/plugins/super-forms/uploads/php/files/62anqk2v6nuvg3oe6bv2rcga8o/kilepisalexof.pdfIn PDF document text
- https://vestol.bg/files/file/30687559613.pdfIn PDF document text
- http://ohstigers66.com/clients/d/da/da15611725e7ba20b6827cbf2e24f87d/File/vaxolivaxaze.pdfIn PDF document text
- https://www.saltriot.com/wp-content/plugins/super-forms/uploads/php/files/018ee3ada88e847e9b8285d28fcde549/dajorekawufibi.pdfIn PDF document text
- http://nhs1966reunion.com/clients/1/1c/1ca8f1639ee69cd7806809ed3bcda9bb/File/torasivelewideguwafixalu.pdfIn PDF document text
- http://unicorn-furnitures.com/d/files/99820755666.pdfIn PDF document text
- http://odmooregolf.com/clients/e/e7/e7046aca88cfcc92de0be8f3f6b3de3d/File/17045720547.pdfIn PDF document text
- https://elpmarketing.ca/wp-content/plugins/super-forms/uploads/php/files/2b624c7689df09fb2fe6ab7b2f3112ac/gejupukububilam.pdfIn PDF document text
- https://joepromenshealth.com/wp-content/plugins/super-forms/uploads/php/files/219f937f121748545b549e2ab76fe764/lapifok.pdfIn PDF document text
- http://dostavkaturov.ru/files/file/8747300099.pdfIn PDF document text
- http://karate-talence.com/newsite/userfiles/files/67363404488.pdfIn PDF document text
- https://championsforchildren.org/wp-content/plugins/super-forms/uploads/php/files/aa25e3e9a7f373047e48199eca26e013/35446724023.pdfIn PDF document text
- http://hugslock.com/app/webroot/img/files/24522696198.pdfIn PDF document text
- http://yuha.be/_files/file/farenotejanuwi.pdfIn PDF document text
- http://chinazzjx.com/d/files/81111254690.pdfIn PDF document text
- http://yoron.net/up/files/vavupelelewo.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f1b6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF1B6 | 10372 bytes |
SHA-256: ffea8b0f685cc6a5d44459b2880e5714c32efe9446e444f05f49220ac88280eb |
|||
font_01_sfnt_off000108e9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x108E9 | 17328 bytes |
SHA-256: 54aaa557ef34bb5052495e038c8a4013416d0f0b4270d7636769cc9cbba18a11 |
|||
font_02_sfnt_off00013539.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13539 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.