MALICIOUS
146
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains numerous embedded URLs, many of which point to potentially compromised websites or disposable hosting, indicating a link farm designed to redirect users. The ClamAV detection and heuristic firings like 'PDF_SEO_DISPOSABLE_LINK_FARM' and 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' strongly suggest malicious intent, likely for phishing or malware distribution. No scripts were extracted from this sample.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4417
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Clickable URI points to raw IP address medium PDF_URI_IP_LITERALPDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILEDThe cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://miaousland.fr/ckfinder/userfiles/files/20065976943.pdf In PDF document text
- http://www.armstrongre.com/files/files/58962407633.pdfIn PDF document text
- https://manenshop.com/upload/files/95511754172.pdfIn PDF document text
- https://emilline.dk/ckfinder/userfiles/files/rabonofipumuleve.pdfIn PDF document text
- http://ewhamd.net/upFiles/ckeditor/files/96034166472.pdfIn PDF document text
- https://agribusiness.pk/wp-content/plugins/formcraft/file-upload/server/content/files/16133374d3dc53---takonu.pdfIn PDF document text
- https://kalimati.in/userfiles/file/watowixezoraja.pdfIn PDF document text
- http://obasekiestates.com/UserFiles/file/24249156455.pdfIn PDF document text
- https://livresdarts.com/ckfinder/userfiles/files/94818104908.pdfIn PDF document text
- http://bobiniauto.com/userfiles/file/daribudijulivogewa.pdfIn PDF document text
- https://www.artikel238.nl/emmwebbit/resources/ckfinder/userfiles/files/75636750474.pdfIn PDF document text
- http://schokobrunnen.com/idata/nutuwadapuxitivul.pdfIn PDF document text
- https://www.dyna-tech.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1612f166a6b1c0---nipigedapojetonivip.pdfIn PDF document text
- http://associatedreclaimed.reclaimedoils.com/userfiles/files/82196796854.pdfIn PDF document text
- http://ibshop.gr/uploads/_uploads/files/50451597100.pdfIn PDF document text
- https://www.jemelectric.com/wp-content/plugins/formcraft/file-upload/server/content/files/1613ac09ce36ca---9138058006.pdfIn PDF document text
- http://china-guolin.com/filespath/files/20210904233709.pdfIn PDF document text
- http://richmore.kr/uploadfile/fckeditor/file/zifekalu.pdfIn PDF document text
- https://naveenent.com/administrator/imagetemp/file/juwalemupodowigelezabake.pdfIn PDF document text
- https://www.peeryhotel.com/wp-content/plugins/super-forms/uploads/php/files/4476a96fc85e0f59e8ba7b7b7949db18/kevobim.pdfIn PDF document text
- http://140.121.125.49/ckfinder/userfiles/files/20210907_234722.pdfPDF link annotation
- http://erbamedica.org/userfiles/files/fanurig.pdfIn PDF document text
- http://knowleangling.co.uk/ckfinder/userfiles/files/gonofidimuzobiz.pdfIn PDF document text
- http://nsdadventist.org/FCKData/file/pafokiva.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=como+volver+root+mi+androidPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d231.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD231 | 17936 bytes |
SHA-256: 06dfac3c9f4840f8de45c63bc56fb26f87c0e1e4db09ac3316b1d497d4356d6a |
|||
font_01_sfnt_off000100ef.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100EF | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_02_sfnt_off00011906.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11906 | 10340 bytes |
SHA-256: 9f66f57f7ac89746823135bc67c08a4fd4e4b8c0c39e3d3861f4ae55fc3e5d68 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.