MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a link farm with numerous URLs, many pointing to compromised WordPress sites. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a malicious intent, likely to lure users to phishing sites or download further malware. The document body is heavily obfuscated and unreadable, providing no direct content clues.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4208
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://bmhs71.com/clients/c/c9/c97ff408e01126d63256cf68004d6641/File/giraza.pdf In PDF document text
- http://stylekd.ru/files/73560458419.pdfIn PDF document text
- http://dmn.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160e08afa0559a---46888721841.pdfIn PDF document text
- https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/160719f857fb59---tomogafexunuwiz.pdfIn PDF document text
- https://dimensioninteractive.com/WYSIWYGImage/file/rutilum.pdfIn PDF document text
- https://slaterlighting.com/wp-content/plugins/super-forms/uploads/php/files/82bafc90862a34addbfb2062eaec1a40/83775340075.pdfIn PDF document text
- https://rrvchefs.com/wp-content/plugins/super-forms/uploads/php/files/faadd20cd80ec1360ddaf25f817fa5e3/zejorozuzanar.pdfIn PDF document text
- http://nappsa.org/userfiles/file/sagodi.pdfIn PDF document text
- https://www.accidentinjurylascruces.com/wp-content/plugins/super-forms/uploads/php/files/kaa45bjqgtceqlq45q1ngl3h11/dezerijigawajonisobok.pdfIn PDF document text
- https://criteriacambio.com.br/wp-content/plugins/super-forms/uploads/php/files/81495tb7ln1q7it0m6k1ft5pen/88051574434.pdfIn PDF document text
- https://www.arc-welding.co.uk/wp-content/plugins/super-forms/uploads/php/files/3pgspre91767i0tm6bm6j014aq/30236607724.pdfIn PDF document text
- http://sugarfree-gelato.com/upload/file/gurozitipipozoli.pdfIn PDF document text
- http://cedresarquitectura.com/wp-content/plugins/formcraft/file-upload/server/content/files/160985b2342e18---46340063355.pdfIn PDF document text
- http://chnli.tw/CKEdit/upload/files/89821129497.pdfIn PDF document text
- https://agrotehholding.ru/wp-content/plugins/super-forms/uploads/php/files/529275d4cabc2352ebc7053272204bb3/wajafazoxevisir.pdfIn PDF document text
- http://eventcompany.org/clients/e/e3/e30ef11cf4efe639fe6592aa37b9cb94/File/18023347629.pdfIn PDF document text
- https://diversifiedhumansolutions.com/wp-content/plugins/super-forms/uploads/php/files/b236da2ceb25788200b321a60217ccc5/69961237931.pdfIn PDF document text
- https://www.azulejositurry.com/wp-content/plugins/super-forms/uploads/php/files/51evjkmthi78qp99f84dsurku4/85609003477.pdfIn PDF document text
- https://www.denisonlandscaping.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bdbd4578726---90012721271.pdfIn PDF document text
- http://in-dapt.com/wp-content/plugins/formcraft/file-upload/server/content/files/160d8e18bdd65f---widesapa.pdfIn PDF document text
- https://earthideasawnings.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609fa246e6480---2553706227.pdfIn PDF document text
- http://project-st.ru/userfiles/file/puxunedijutafanawolu.pdfIn PDF document text
- https://psychologgia.pl/Upload/file/6346698387.pdfIn PDF document text
- https://www.siemers-deutschmann.de/wp-content/plugins/super-forms/uploads/php/files/rsl2v83sea7eeq7vt52go4j3i4/13178736323.pdfIn PDF document text
- http://osrclass1967.com/clients/8/84/84e84eb3bb32f45446e669e24fea3ebc/File/21677622757.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/YTWXjIUwRh0/uplcv?utm_term=red+discoloration+on+armsPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f3cf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF3CF | 17284 bytes |
SHA-256: 454951f31b033c5a40bb4afc4aa672276f542be447d8b13648e3ca0e76cf2262 |
|||
font_01_sfnt_off00012128.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12128 | 10576 bytes |
SHA-256: 75f5b04e9833b4eed758daffd7bab32887b70ec02480ffc70f5fe47685d90e1d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.