MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains numerous external links, many of which point to compromised websites or disposable domains, indicating a link farm designed to redirect users. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a malicious intent, likely phishing or malware delivery through these links. The presence of multiple external URIs and link farm heuristics confirms the attack pattern.
Machine Learning
- Nyx PDF Classifier clean score 0.2270
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://irlanc.ru/uplcv?utm_term=balancing+chemical+equations+worksheet+answer+key+gizmo PDF link annotation
- https://nutritie-metabolism-sanatate.ro/app/webroot/files/userfiles/files/felopozogaxononalolakawe.pdfIn PDF document text
- http://hadt.vn/upload/files/67191897823.pdfIn PDF document text
- http://reclaimsplus.com/wp-content/plugins/super-forms/uploads/php/files/fc9a086ec63a9734191b49a2515321fc/semerapofanotodomavifemu.pdfIn PDF document text
- http://tindangnhadat.vn/upload/files/pupazanujojalomep.pdfIn PDF document text
- http://romovi.net/sgi_userfiles/userfiles/files/wajovabonasefif.pdfIn PDF document text
- http://norilskgu.ru/userfiles/file/12861778313.pdfIn PDF document text
- http://grasslandtj.com/upload/files/86529789673.pdfIn PDF document text
- https://clubkdo.fr/img/pics/files/47023169925.pdfIn PDF document text
- http://lamorenj.com/userfiles/file/74910507965.pdfIn PDF document text
- https://desense.eu/uploads/wysiwyg/files/28516797345.pdfIn PDF document text
- http://ibb-online.ru/f/file/zorixoj.pdfIn PDF document text
- http://pravkniga.ru/files/userfiles/files/20737205515.pdfIn PDF document text
- http://tornyanggrace.com/upload/file/90455076313.pdfIn PDF document text
- http://ajtoablakcentrum.com/_user/file/zaxipirabefidol.pdfIn PDF document text
- http://vector-mebel.ru/uploads/files/xinivizew.pdfIn PDF document text
- https://expungemyrecordnj.com/wp-content/plugins/formcraft/file-upload/server/content/files/16134cd1cbc408---71172878729.pdfIn PDF document text
- https://ivfnna.gr/wp-content/plugins/super-forms/uploads/php/files/959af065827ecaab51eb386e102ef109/14554336347.pdfIn PDF document text
- https://flylights.pl/wp-content/plugins/super-forms/uploads/php/files/6hups4dfv0fhuhigqpkflnhk29/kidajodajabidogomeve.pdfIn PDF document text
- http://ghettaetamionarchitetti.it/userfiles/files/femifegepozo.pdfIn PDF document text
- https://tiguan-wiki.ru/file/jujubami.pdfIn PDF document text
- https://smarttactic.ro/wp-content/plugins/formcraft/file-upload/server/content/files/1613076365bfda---38453413870.pdfIn PDF document text
- http://proart.by/media/file/38180013620.pdfIn PDF document text
- https://www.hospedeagora.com.br/wp-content/plugins/super-forms/uploads/php/files/mr1ivrrsr517cd4g82ra0sob3s/99884253454.pdfIn PDF document text
- http://centroolosprato.it/userfiles/files/lojusofewopok.pdfIn PDF document text
- http://clubselectionvoyages.net/images/file/24273412120.pdfIn PDF document text
- https://pre-www.bridge-academy.com/uploaded/ckeditor/files/womotevisovupe.pdfIn PDF document text
- http://hp-cnc.de/uploads/files/96953437579.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001f220.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1F220 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00020a37.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x20A37 | 11328 bytes |
SHA-256: 9e282d46a9e2f3c70f564c3cea2ef4ff62e6797cc789885bac7d8fe2a990c110 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.