MALICIOUS
166
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.5565
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://sunuf.co.za/XSRYdR1H?utm_term=free+business+card+psd+template PDF link annotation
- http://majstrissmt.eu/www-data/file/genini.pdfIn PDF document text
- https://conexus-study-abroad-travel.com/ckfinder/userfiles/file/2299124304.pdfIn PDF document text
- https://netwindowvn.com/uploads/userfiles/file/6006505043.pdfIn PDF document text
- http://usateatop.com/_upload/files/36655983268.pdfIn PDF document text
- https://xlquality.com/userfiles/file/92479624268.pdfIn PDF document text
- http://emcmotorbikerental.com/asset/kcfinder/upload/files/moxumufalisagopepirabu.pdfIn PDF document text
- http://woonhuislift.info/wp-content/plugins/formcraft/file-upload/server/content/files/16212440a48042---nazesatapore.pdfIn PDF document text
- https://4dapi.glg228.info/app/webroot/uploads/files/66768858029.pdfIn PDF document text
- https://rayvoltbike.tw/geektic/files/lunaxomek.pdfIn PDF document text
- https://joepromenshealth.com/wp-content/plugins/super-forms/uploads/php/files/5a4844f662957272d0e3761371aee609/54539424939.pdfIn PDF document text
- http://criminisiepartners.it/userfiles/files/niwuxivatefopudak.pdfIn PDF document text
- https://ohligschlaeger-berger.de/wp-content/plugins/formcraft/file-upload/server/content/files/1621431f482276---66397113430.pdfIn PDF document text
- https://vntdc.com/upload/fck/file/69802657823.pdfIn PDF document text
- http://vinhthuan.vn/upload/files/31979511094.pdfIn PDF document text
- http://thienlongadv.com/upload/files/72713508322.pdfIn PDF document text
- http://rebornfair.com/FileData/ckfinder/files/20220227_6DCD0194F865BC58.pdfIn PDF document text
- http://chestheart.org/journal/assets/ckeditor/kcfinder/upload/files/66997447155.pdfIn PDF document text
- http://xn--aknmedical-yub.com/uploads/file/81791677179.pdfIn PDF document text
- https://supportsurgical.com.br/assets/kcfinder/upload/files/buvovifumijisuruxukag.pdfIn PDF document text
- http://stylowa-pss.pl/userfiles/file/69658438315.pdfIn PDF document text
- https://vajdasaraegyesulet.hu/kcfinder/upload/files/rifufetopaxexujawonag.pdfIn PDF document text
- https://lochoanggia.com/upload/files/wubapavawipaki.pdfIn PDF document text
- http://ekhoron21.mn/uploads/files/52251374356.pdfIn PDF document text
- http://nakamurasangyou.jp/app/webroot/uploads/files/xivajogopi.pdfIn PDF document text
- http://kfnmdg.com/upfolder/e/files/20220214030047.pdfIn PDF document text
- https://jeevadhara.org/work/london/userfiles/file/28110620972.pdfIn PDF document text
- http://dautuck.com/uploads/userfiles/file/88744921687.pdfIn PDF document text
- http://airholic.com/UpFiles/WebEditorFiles/file/10663890877.pdfIn PDF document text
- https://smartbrand.ro/mm/file/24503374746.pdfIn PDF document text
- https://r4binsh4h9-att.com/contents/files/65318013180.pdfIn PDF document text
- http://formasrl.com/admin/kcfinder/upload/files/88249868716.pdfIn PDF document text
- https://leg-vein.jp/kcfinder/upload/files/nuzomamojizarivotutojuvu.pdfIn PDF document text
- https://www.ocnistudio.cz/ckfinder/userfiles/files/99836962038.pdfIn PDF document text
- https://suhrsmad.dk/wp-content/plugins/formcraft/file-upload/server/content/files/161f8a9b0b7c90---diwaderusimeso.pdfIn PDF document text
- http://vagyonvedelemszolnok.hu/admin/fck_upload/file/poxusefofotir.pdfIn PDF document text
- http://cadex-forensic.com/app/webroot/kcfinder/upload/files/43139506904.pdfIn PDF document text
- https://tsolisp.com/files/file/futavidozolenasotudatu.pdfIn PDF document text
- https://tdh-europe.org/files/files/lubogikujugelizesid.pdfIn PDF document text
- http://afslab.asia/upload/files/67535581772.pdfIn PDF document text
- http://turnkeyparts.com/site-uploads/48515497249.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16229fa1c0e60a---pufideluzerefefenizup.pdfIn PDF document text
- http://urs-certification.com/gais/image/file/62977569778.pdfIn PDF document text
- https://burstallconrad.com/editor_files/file/57251659313.pdfIn PDF document text
- http://gnatowski.pl/attachments/file/15874930203.pdfIn PDF document text
- https://sumangold.net.vn/wp-content/plugins/super-forms/uploads/php/files/coi34j736m9p9ie9s9pt35fmt1/65801519593.pdfIn PDF document text
- https://smobiil.eu/userfiles/files/vamavugorib.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
+5 more URL(s)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0004ef6b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x4EF6B | 18760 bytes |
SHA-256: f01b2d7c42f0bbd2a786b640b42fc183010e440318156763f34e713995f8824f |
|||
font_01_sfnt_off000520ac.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x520AC | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_02_sfnt_off000537d1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x537D1 | 10772 bytes |
SHA-256: 847be08bce6b491bf9ddbe851bef000d56e9e34d93f65adf0b1cb846ac7f9ee7 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.