MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The file was detected as a malicious PDF by ClamAV, indicating it likely exploits PDF vulnerabilities or contains malicious content. Heuristics reveal it functions as a link farm, directing users to numerous external PDF files hosted on various domains, some of which appear to be compromised CMS uploads. This suggests a phishing or malware distribution scheme, where the embedded links are intended to lure victims to malicious content.
Machine Learning
- Nyx PDF Classifier suspicious score 0.2801
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://wastran.ru/uplcv?utm_term=redox+reaction+ncert+textbook+pdf PDF link annotation
- https://vandolderskb.com/images/usr/17251352451.pdfIn PDF document text
- http://cassotech.nl/site/data/ws/files/71550410067.pdfIn PDF document text
- https://elitestrategyglobal.com/wp-content/plugins/super-forms/uploads/php/files/c07c84aee4c7b2c7c8041d49ad311cd0/76752861920.pdfIn PDF document text
- http://music-summer-courses.eu/upload/files/62932147307.pdfIn PDF document text
- http://citra.cl/userfiles/file/59647505981.pdfIn PDF document text
- https://www.americanapi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a934ea6b776---68014130531.pdfIn PDF document text
- https://www.inter-tube.co.uk/wp-content/plugins/super-forms/uploads/php/files/1e06a2acf34ac6ada6903ebfb73a4a21/84540431115.pdfIn PDF document text
- http://bi-acaovo.com/upload/files/23409692576.pdfIn PDF document text
- https://chungcungoaigiao.net/uploads/files/75151832407.pdfIn PDF document text
- https://premium-house.uz/images/file/44898671415.pdfIn PDF document text
- https://purpleleafestatebuyers.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ae9b0961029---rorunazorabizonet.pdfIn PDF document text
- http://penzionnakrizankach.cz/ckfinder/userfiles/files/zuwimoxofelizu.pdfIn PDF document text
- http://www.pantonerestauri.com/ckfinder/userfiles/files/41977455500.pdfIn PDF document text
- https://thealloywheelcentre.co.uk/wp-content/plugins/super-forms/uploads/php/files/451cd8d02f5bf2ba8ba361283bd17965/99355978370.pdfIn PDF document text
- https://afanasyev-design.ru/wp-content/plugins/super-forms/uploads/php/files/40b8eda943aa27a7814368c024833c41/noketobo.pdfIn PDF document text
- http://globalroomplus.com/bot/ckfinder/uf/files/42352785179.pdfIn PDF document text
- http://nawooelcs.com/upload/userfiles/2021/08/files/210809104204.pdfIn PDF document text
- http://fortlauderdalelimorental.net/wp-content/plugins/formcraft/file-upload/server/content/files/1607de1b79d7fc---xorano.pdfIn PDF document text
- http://ppfi-online.com/userfiles/file/lufipinitubilapitaxafuvi.pdfIn PDF document text
- https://bf-pomosch.ru/wp-content/plugins/super-forms/uploads/php/files/uf9dovpbqvabmea3m2q8fvk0n0/luxomojaxeninosekizabi.pdfIn PDF document text
- https://marblo.ph/app/webroot/img/files/49699337583.pdfIn PDF document text
- http://aquarium-kochi.com/app/webroot/ckfinder/userfiles/files/roxibarumuxabaxojumotesu.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000120bf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x120BF | 10776 bytes |
SHA-256: a4a4869da75568579f396914caded53e7dee84f51613331c5270a364ef86795e |
|||
font_01_sfnt_off00013974.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x13974 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_02_sfnt_off00015186.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x15186 | 19012 bytes |
SHA-256: 6c0d32687d53514174d0b923d73cafcb2c60ccc1362a75cfcc0f0ebc53d667a6 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.