MALICIOUS
132
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF contains embedded JavaScript and a significant number of external URIs, many of which point to compromised CMS uploads or disposable hosting. These links form a link farm, likely intended to redirect users to phishing pages or download further malware. The ClamAV detection as 'Pdf.Phishing.Trojan' further supports this assessment.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4169
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
Embedded JS stream low PDF_JSPDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://catamma.ru/uplcv?utm_term=the+fate+of+the+furious+full+movie+online+free PDF link annotation
- http://lindendirect.com/tempimg/file/39981962418.pdfIn PDF document text
- http://www.fotografoeventimilano.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612f43a90de27---gafarizalaxokemozuwurofe.pdfIn PDF document text
- http://yey.uw52.com/upload/files/29804551420.pdfIn PDF document text
- http://raduzhniy.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612fd445174a5---dulaxezakajolike.pdfIn PDF document text
- https://knurussian.kr/DATA/upload/files/202109041729293107.pdfIn PDF document text
- http://xn--ob0bjxt9h99icicrvkksa421cwwp7hiv4d6a.com/ckfinder/userfiles/files/mezegotududuvikunamavi.pdfIn PDF document text
- https://sona3elkhair.com/userfiles/file/kaxujegafudujazegexixux.pdfIn PDF document text
- https://gk-termopanel.ru/wp-content/plugins/super-forms/uploads/php/files/be545135fdd0b27d88058847e5a45533/muvedijoximimibovavosi.pdfIn PDF document text
- https://voicelux.ru/wp-content/plugins/super-forms/uploads/php/files/3b3a35624de269d0b2453841b0dfe1a2/33981152324.pdfIn PDF document text
- http://www.johnrealestate.in/ckeditor-ckfinder-integration/uploads/files/42335926528.pdfIn PDF document text
- http://hokkaido-love87.com/app/webroot/js/ckfinder/userfiles/files/somifawunar.pdfIn PDF document text
- http://www.peltonfell.org.uk/ckfinder/userfiles/files/64313000107.pdfIn PDF document text
- https://gelblighting.com/userfiles/files/giregajupagegezelosad.pdfIn PDF document text
- http://fskyok.com/uploadfile/files/godidunoriwokuzijotej.pdfIn PDF document text
- http://joshuadacosta.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612faac27b44b---29169753875.pdfIn PDF document text
- https://pharmawell.eu/ckfinder/userfiles/files/ruxobezolanejew.pdfIn PDF document text
- http://pusancard.com/userData/board/file/zenufumevaloxekawavama.pdfIn PDF document text
- https://spotiverify.com/ci/userfiles/files/80277101735.pdfIn PDF document text
- http://huile-de-nigelle.info/userfiles/file/mojovinugemuvarebibopafi.pdfIn PDF document text
- http://www.myhhsi.com/wp-content/plugins/super-forms/uploads/php/files/6cd84cd7ac685b01714c5182b44af6af/89913622875.pdfIn PDF document text
- http://msdoubrava.cz/foto/images/file/97643512560.pdfIn PDF document text
- https://fotojursa.cz/userfiles/file/30245109776.pdfIn PDF document text
- http://southportrubbish.com/wp-content/plugins/formcraft/file-upload/server/content/files/16136aa88c7184---49417671579.pdfIn PDF document text
- http://giaydantuongphongkhach.net/images/news/file/wujegupixome.pdfIn PDF document text
- http://www.jucadent.es/ckfinder/userfiles/files/tewunegugabejipamikezixar.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e8cb.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE8CB | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off000100e2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x100E2 | 10608 bytes |
SHA-256: 9bf37034da3b5bec69b00686e74813cfbb2b3ff96982092b402144986e2892ef |
|||
font_02_sfnt_off000118f6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x118F6 | 18336 bytes |
SHA-256: 56c1b7134358d36f8a4818eb209561e35ae814e00863189cf74ce7d591b03d3a |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.