MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains a link farm pointing to multiple compromised WordPress sites, indicating a phishing or malware distribution attempt. ClamAV detected this file as 'Pdf.Phishing.Trojan', and ML classifiers also flagged it as malicious. The embedded URLs suggest a tactic of using compromised infrastructure to host malicious content or redirect users to phishing pages.
Machine Learning
- Nyx PDF Classifier malicious score 0.9835
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jclifeschools.org/wp-content/plugins/super-forms/uploads/php/files/de637096169790f37b8537f1435c1309/94688526784.pdf
- http://geasit.it/userfiles/files/30651431859.pdf
- http://joelcsimonesq.com/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/85583509790.pdf
- https://vietucmould.com/img-vietuc/files/97140382757.pdf
- https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/desatmg51t0d9pfq7q74eg4e07/614865250.pdf
- http://erbilsunhotel.com/wp-content/plugins/super-forms/uploads/php/files/3kf94r26212a545f3de5mn76a6/14542104735.pdf
- http://mfplus.ba/wp-content/plugins/formcraft/file-upload/server/content/files/1608a65f714bc0---63676717442.pdf
- https://www.andeanskyline.com/wp-content/plugins/formcraft/file-upload/server/content/files/160e3321ddbc16---jixabatuvupifogewuweji.pdf
- http://2girlstrippin.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b32cb529138---niboxipe.pdf
- https://www.gml.de/wp-content/plugins/formcraft/file-upload/server/content/files/160810a265ee41---13366471521.pdf
- https://engineeredrepinc.com/wp-content/plugins/super-forms/uploads/php/files/bf47158badae8b6bc0d06e8abf75dc9a/76425928455.pdf
- https://www.chortho.co.uk/wp-content/plugins/super-forms/uploads/php/files/h9019qhhk1l5k22k5g4m275m03/jagipuvok.pdf
- http://gsoam.ge/wp-content/plugins/formcraft/file-upload/server/content/files/1609a6b86d9f0c---51001227012.pdf
- https://kicksomeglass.com/wp-content/plugins/super-forms/uploads/php/files/1f2d0134f23f6bd72fe2cb2804c290d2/wuzeworubebatu.pdf
- https://www.gs-gleichmann.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c5197d508bd---fowepukirosuj.pdf
- http://www.sg-callenberg.de/wp-content/plugins/formcraft/file-upload/server/content/files/16086f06047ac3---fitikilisadapesow.pdf
- http://megat.pl/uploaded/fck_files/file/9232077273.pdf
- http://ceramicaartisticamarsalese.it/userfiles/files/10380046511.pdf
- https://grafitpoint.ru/wp-content/plugins/super-forms/uploads/php/files/61e7e4c7871b6729323b51f9279fdfee/gabamapabaxibovev.pdf
- http://suachuaspa.com/upload/images-content/files/fakukisisurigufipotevezu.pdf
- https://www.edutechusa.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a258dd319cf---36494904106.pdf
- http://www.barankayalar.com.tr/wp-content/plugins/formcraft/file-upload/server/content/files/1609d17227d04a---xisazelokopit.pdf
- https://canadianrelocation.net/wp-content/plugins/formcraft/file-upload/server/content/files/160d02e3742ee2---sipugel.pdf
- https://malashealthcare.com/userfiles/files/45059496552.pdf
- https://castel.ro/userfiles/file/mowofaki.pdf
- http://www.johnknox.ch/wp-content/plugins/formcraft/file-upload/server/content/files/160b4d09d99119---91038143309.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/zMnd8XtcwSM/uplcv?utm_term=icomania+guess+the+movie+answers
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f6d0.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF6D0 | 16792 bytes |
font_01_sfnt_off00010ee7.bin6f259ba16555d6cca9f179f6b4a658b0a0736a5eab26293cfe3aa6558214bbc4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10EE7 | 10836 bytes |
font_02_sfnt_off000127cd.binadcdefe94baecc8e4f0f82f9bba12f38a6ce85766b1f9b98ed4f97f9b594b6e6 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x127CD | 17888 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.