MALICIOUS
166
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.6275
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://bc-nosingtasting.com/bestanden/files/10797896698.pdf In PDF document text
- https://www.bluelabs.it/shazar/admin/assets/js/ckeditor/kcfinder/upload/files/files/titakumitubofofuloxazo.pdfIn PDF document text
- http://alnadaoil.com/userfiles/file/bezulawo.pdfIn PDF document text
- http://avrasyated.org/nedmin/production/ckeditor/kcfinder/upload/files/76471997633.pdfIn PDF document text
- http://4grd.com/cmsimages/file/wodanejuxaxujew.pdfIn PDF document text
- https://hotelindigha.com/FCKeditor/file/murovagumowigikamurule.pdfIn PDF document text
- http://behtarinekhodetbash.com/files/files/45373511695.pdfIn PDF document text
- http://mytenniscoach.net/admin/ckeditor/kcfinder/upload/files/telaliwidilix.pdfIn PDF document text
- http://hoclaixebinhthuan.com/upload/contentFile/file/xakudegugevulutowudoja.pdfIn PDF document text
- http://carmakers.cz/userfiles/files/78872513767.pdfIn PDF document text
- https://gift-edu.ru/wp-content/plugins/super-forms/uploads/php/files/27f6335e116c056cd94698a2645698c9/20460523399.pdfIn PDF document text
- http://xy-interior.com/uploads/files/202203062207325316.pdfIn PDF document text
- http://hiroi-es.info/yamituki-n/uploads/files/3705153021.pdfIn PDF document text
- https://noks.cz/wp-content/plugins/formcraft/file-upload/server/content/files/162184c33cb94b---95404787382.pdfIn PDF document text
- http://batteryzone.pk/assets/kcfinder/upload/files/nozezerufigojakuwapunage.pdfIn PDF document text
- http://appextskihjthj.handysociality.com/upload/files/woruzudejetudumuralal.pdfIn PDF document text
- http://odpadykj.cz/UserFiles/File/luweja.pdfIn PDF document text
- https://vatlieubaooncachnhiet.com/userfiles/file/31196913388.pdfIn PDF document text
- https://mebelihome.ru/upload_picture/budidegulofinej.pdfIn PDF document text
- http://www.biosafety.biz/ckfinder/userfiles/files/50519357499.pdfIn PDF document text
- http://shriadinathbank.com/uploads/xepoxigoxapusi.pdfIn PDF document text
- https://magiccat.pro/ckfinder/userfiles/files/30361159990.pdfIn PDF document text
- http://www.podunajsko.sk/app/webroot/ckeditor/kcfinder/upload/files/66070940278.pdfIn PDF document text
- http://bergfin.se/wp-content/plugins/formcraft/file-upload/server/content/files/161f9555503a1f---vifafubetoreg.pdfIn PDF document text
- http://vamaconsulting.sk/userfiles/file/62237831710.pdfIn PDF document text
- http://salda.lt/saldus/kcfinder/upload/files/zixeduvidesa.pdfIn PDF document text
- http://optykglowacki.pl/obrazki/files/22359411226.pdfIn PDF document text
- http://progfin.pl/userfiles/file/kanirojezig.pdfIn PDF document text
- https://longhoang.vn/upload/files/82183964797.pdfIn PDF document text
- http://riversedgefm.com/files/file/vogawavajixedupoboja.pdfIn PDF document text
- http://tbeaindia.com/userfiles/file/kuxikiwutef.pdfIn PDF document text
- http://syntrend.critical.tw/upload/files/73561249658.pdfIn PDF document text
- http://jesupraguefilm.cz/pic/files/96977480343.pdfIn PDF document text
- http://spbmedax.ru/sites/default/files/uploads/54414952439.pdfIn PDF document text
- http://sjanzee.nl/file/ludidepevo.pdfIn PDF document text
- http://artemovsk.topmebli.com/content/xuploadimages/file/tazuku.pdfIn PDF document text
- https://www.madenisg.org.tr/kcfinder/upload/files/34714315114.pdfIn PDF document text
- https://fxafidelite.megazone-reims.com/userfiles/file/giwipemubizopexagat.pdfIn PDF document text
- http://aktifimmo.lu/userfiles/files/89403024674.pdfIn PDF document text
- http://www.mediagrand.hu/data/editorfile/gefigivetux.pdfIn PDF document text
- https://norin.co.za/XSRYdR1H?utm_term=convert+pdf+to+word+app+iphonePDF link annotation
- https://sgpm.krakow.pl/aaeventy/kcfinder/upload/files/74648892147.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off00031849.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off00031849.bin)
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00031849.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x31849 | 18596 bytes |
SHA-256: 5f6519b105641edb377d00b618300270805cad2cdc36c92cc028fd93bd993a43 |
|||
font_01_sfnt_off00034951.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x34951 | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
font_02_sfnt_off00036072.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x36072 | 10564 bytes |
SHA-256: 8ac1cb9a33bc5de4d2273bd7d0c55d0e5898cba98132b9bb08db93dfdd48339b |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.