MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains a link farm pointing to multiple compromised WordPress sites, with one URL specifically identified as leading to a PDF hosted on such a site. While no scripts were explicitly extracted, the nature of the link farm and the 'compromised_cms_upload_link_farm' heuristic suggest the PDF is designed to redirect users to malicious content, likely for phishing or further malware delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9763
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.gcsystem.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160c3a869b9a06---61776142990.pdf In PDF document text
- http://www.musicmaestrodiscos.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1609ec54cb2dac---kusezudexokariw.pdfIn PDF document text
- https://www.dynasil.com/wp-content/plugins/super-forms/uploads/php/files/0dfe696d6f63482a853c951b5389b144/5187742703.pdfIn PDF document text
- http://rauvuonsach.net/images/uploads/files/57740599668.pdfIn PDF document text
- http://inwallendorf.de/userfiles/file/31427217521.pdfIn PDF document text
- https://netron.pt/app/webroot/media/files/77214593868.pdfIn PDF document text
- http://wang023spa.com/userfiles/202108file/2021080718563870554.pdfIn PDF document text
- http://sieckultury.pl/wp-content/plugins/super-forms/uploads/php/files/79934dcb30dfd119efe8e6f99861efde/jonowilevemuji.pdfIn PDF document text
- http://www.sphotobooth.com/wp-content/plugins/formcraft/file-upload/server/content/files/160724a0f15cc8---lafoneruxumevozotad.pdfIn PDF document text
- https://purpleleafestatebuyers.com/wp-content/plugins/formcraft/file-upload/server/content/files/1611b31454f407---ralozubibezuxunakuku.pdfIn PDF document text
- http://droprint.my/home/ququ4923/public_html/userfiles/file/majuxuvimifow.pdfIn PDF document text
- http://agro-vostok.ru/userfiles/file/vomigegedexekebewujupad.pdfIn PDF document text
- https://usssecuritate.ro/userfiles/file/pakiziwasani.pdfIn PDF document text
- http://capmar.eu/userfiles/file/48452713526.pdfIn PDF document text
- https://amkboiler.com/wp-content/plugins/super-forms/uploads/php/files/atp5m6bbhrlhkdcrnddiqrnkp0/xaduzolakumevikamujad.pdfIn PDF document text
- http://1-champagne.com/blog_images/blog_/file/wijurorut.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/160803bc50090f---74453573396.pdfIn PDF document text
- https://ukmriptek.org/codeIgniter-hmvc/userfiles/files/dejewefatipukotaxadoni.pdfIn PDF document text
- http://bright-mineral.com/uploadfile/file/2021070410582525.pdfIn PDF document text
- http://www.sunargrup.com.tr/wp-content/plugins/super-forms/uploads/php/files/1k5cnpfa1d9mpvvskf0kdlaet1/nugijotodafufoj.pdfIn PDF document text
- http://highspiritsmusic.com/ckfinder/userfiles/files/97205375035.pdfIn PDF document text
- http://www.derbysignandgraphics.com/uploads/file/18437705581.pdfIn PDF document text
- https://www.quatainvestimentos.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/1609fd8d9025ed---vakiwedusebur.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/BkSY9tpko7c/uplcv?utm_term=to+kill+a+mockingbird+chapter+18+21+vocabularyPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002aac1.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2AAC1 | 16568 bytes |
SHA-256: 7148a9b301f4f71e11bdd9dbbdcafcf74ef1c6aa6397007158a4674c0e62254a |
|||
font_01_sfnt_off0002d5c4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2D5C4 | 11648 bytes |
SHA-256: c3522a60c536bbab07e47d5fb67bd79c9eb3d772781bbf05cc40d674885a4c54 |
|||
font_02_sfnt_off0002f109.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2F109 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.