MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file is identified as malicious by ClamAV with a Pdf.Phishing.Trojan detection. Static analysis revealed multiple heuristics indicating the PDF acts as a link farm, with many URLs pointing to compromised WordPress upload directories. These links are likely designed to redirect users to malicious or phishing content, making the primary attack pattern a lure to external malicious sites.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4070
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a4b99f3c4a9---72505395189.pdf In PDF document text
- http://warraichmeats.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c7294350c8---75557303958.pdfIn PDF document text
- http://hoondb.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607634fd9b923---lagesuku.pdfIn PDF document text
- http://yngc.ru/admin/ckfinder/userfiles/files/65962915526.pdfIn PDF document text
- http://brmxn.com/userfiles/file/20210525125931_x4jcj6.pdfIn PDF document text
- https://www.horisunmauritius.com/wp-content/plugins/super-forms/uploads/php/files/b0e69b12cdbeb007bb41e02a301b1bfc/takivuxasefusavavoga.pdfIn PDF document text
- http://sh8ke.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607227ea463f4---99558618565.pdfIn PDF document text
- http://www.altrus.pl/wp-content/plugins/formcraft/file-upload/server/content/files/16077795ae9410---gakugun.pdfIn PDF document text
- https://orkhaconstruction.com/wp-content/plugins/super-forms/uploads/php/files/jgne6j45j4r4cvagdv7f6fft95/nagosupoxomubenuve.pdfIn PDF document text
- http://apple888.vn/luutru/files/97175733189.pdfIn PDF document text
- http://www.kevinbrooks.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609ddb4613fd6---fetujeduguwodigo.pdfIn PDF document text
- https://spazmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098e7c3be179---33377357664.pdfIn PDF document text
- https://duzcanlargroup.com/Images/Media/files/patufuzev.pdfIn PDF document text
- https://autotrilogy.com/wp-content/plugins/super-forms/uploads/php/files/8f65f7d705d0c7839b90daa3f8d79c28/87373885638.pdfIn PDF document text
- https://webhostmurah.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a664eaed6f4---sawudaranugexuroger.pdfIn PDF document text
- https://refour.eu/wp-content/plugins/super-forms/uploads/php/files/74e5778e47644b633b09deeb21266b1b/sobanam.pdfIn PDF document text
- http://mousike.it/img_ins/files/91751934145.pdfIn PDF document text
- http://agataklimowska.pl/userfiles/file/80680484023.pdfIn PDF document text
- http://fantasypartyentertainment.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c91f596ab1---15566542707.pdfIn PDF document text
- https://winston-woodward.com/wp-content/plugins/super-forms/uploads/php/files/33c7522296828847e3482424f9625d5c/86158092032.pdfIn PDF document text
- https://nomaquito-travel.com/editor-images/82911462904.pdfIn PDF document text
- https://zweiund40.com/wp-content/plugins/super-forms/uploads/php/files/rli9822ov8aiimc6ivirl0sril/lozojomifililagesaboxuvug.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/LPIa9PGmDLg/uplcv?utm_term=consolidated+industries+furnace+manualPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00017f0e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x17F0E | 10768 bytes |
SHA-256: 851120eea707186f4721db4e9e777b8c334b343dfd00b34f25435a45c2873ce8 |
|||
font_01_sfnt_off000197dc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x197DC | 20168 bytes |
SHA-256: 2b33fbcba00a11fed8b5fc2bfac4c2c3fb520790a811ea2348795bd3fd510b6c |
|||
font_02_sfnt_off0001ccdc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1CCDC | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.