MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document functions as a link farm, directing users to multiple external websites, some hosted on compromised CMS platforms. The presence of numerous links and the PDF_SEO_DISPOSABLE_LINK_FARM heuristic suggest an attempt to manipulate search engine results or distribute malicious content. The file's structure and the nature of the embedded links point towards a phishing or malware distribution scheme.
Machine Learning
- Nyx PDF Classifier malicious score 0.9587
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://sladkiy-ostrov.ru/userfiles/files/wakosilojubexudizosa.pdf
- https://www.prestigeautobody.com.au/wp-content/plugins/super-forms/uploads/php/files/88f55554503a199498096f1024ba2efd/83230202486.pdf
- https://eyestech.in/wp-content/plugins/super-forms/uploads/php/files/0ge48d7bg8tavc67je8nus0qp1/nuxep.pdf
- http://slippersymposium.com/clients/875641/File/24797168190.pdf
- http://niestachow.pl/data/aktualnosci_imgs/file/sevedur.pdf
- https://mediabandit.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606e8539b421a---ririjiwanajopetebolepopuf.pdf
- https://teyadegitimvideo.com/calisma2/files/uploads/vidumudogalusilopozemesi.pdf
- https://alrashed-alsaleh.com/userfiles/files/nugadepafulelunumafew.pdf
- https://lcd96.ru/wp-content/plugins/super-forms/uploads/php/files/c645bbefac006ee80372a3d862f36e0b/37849434109.pdf
- https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/1606da267ec15d---noxudodusidujekix.pdf
- https://bilalyapidekorasyon.com/userfiles/file/25907826779.pdf
- http://unipell.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1607b5b057c8b2---lanoxidanedoval.pdf
- https://www.criteriainvest.com.br/wp-content/plugins/super-forms/uploads/php/files/ler0rhsb5kjed1v53p424b31nq/gumimetep.pdf
- https://tuabogadoangel.com/wp-content/plugins/super-forms/uploads/php/files/c08563b40ad0ebe61f23dbb0569163e6/regolijomeferisepikani.pdf
- http://admio.ru/wp-content/plugins/formcraft/file-upload/server/content/files/160a4c6b13d661---10576382583.pdf
- https://www.cir.cloud/wp-content/plugins/formcraft/file-upload/server/content/files/1607ee23f1da69---rafowedexafuwovuvogomugu.pdf
- http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e78e7e92e0---metisaginuwokiwolek.pdf
- https://independentmusicleague.com/wp-content/plugins/super-forms/uploads/php/files/fd777e39fec383132aaf4c3c807cbf5a/61620026657.pdf
- https://lawyerupsmart.com/tempimg/file/54348199319.pdf
- https://nowackleverkusen.de/wp-content/plugins/formcraft/file-upload/server/content/files/160b9f92253afa---9506356579.pdf
- https://webmodeli.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095a7e0523d3---gomixixitilejibokugolod.pdf
- https://amiablediamonds.com/wp-content/plugins/super-forms/uploads/php/files/f3236e2070124b42d8157f34e0072ca5/gijekopoxebuno.pdf
- http://www.sunarpazarlama.com/wp-content/plugins/super-forms/uploads/php/files/b04lpi4m1ta1h5i6pvckcj4n77/91649676556.pdf
- http://travelshops.pl/userfiles/file/mazeruzebi.pdf
- http://sl1971.com/clients/5/51/517263f0417f9379c67e6eba0e0bdfe8/File/bokolaluvisewiwokepubowi.pdf
- http://anhbanglaw.com/userfiles/file/73057369012.pdf
- https://stefandes.com/wp-content/plugins/formcraft/file-upload/server/content/files/160802f0a2bf1d---53068940935.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=who+wrote+the+book+of+kings+in+the+old+testament
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00028258.binb77581880bf69bf1d54711a4ccfae5af9c3fbd5b7acbe5442cdd5cff30eff0d9 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x28258 | 11112 bytes |
font_01_sfnt_off00029be7.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x29BE7 | 16792 bytes |
font_02_sfnt_off0002b3f8.bin7b97c6b005174ca8a6ed2f82604e4d3ec28f040b573bf94b0c09b7765b7f9bac |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2B3F8 | 17064 bytes |
font_03_sfnt_off0002cd10.binc6b435a618a79f7eb7908d4e95b741157e55e22494afc52a8b46ca3fd4256eba |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2CD10 | 17492 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.