MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous links, many pointing to compromised WordPress sites and disposable hosting, suggesting a link farm or phishing lure. The presence of external URIs and the overall structure point towards an attempt to redirect users to potentially harmful content or exploit vulnerabilities.
Machine Learning
- Nyx PDF Classifier malicious score 0.9835
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://perleyparish.org/wp-content/plugins/super-forms/uploads/php/files/dbace83318bc033f4595a9697b528bb6/mirurol.pdf In PDF document text
- https://www.lipfish.no/wp-content/plugins/formcraft/file-upload/server/content/files/16084aab12531d---difokomudise.pdfIn PDF document text
- https://rescue.bg/wp-content/plugins/formcraft/file-upload/server/content/files/160aa9d3a3412c---83565313718.pdfIn PDF document text
- http://ekolojikweb.net/upld/userfiles/file/vudogokekuxafesejenafukun.pdfIn PDF document text
- http://www.next-conseil.fr/wp-content/plugins/formcraft/file-upload/server/content/files/160abf6eca094f---19532686549.pdfIn PDF document text
- https://reifenscho.de/wp-content/plugins/formcraft/file-upload/server/content/files/160c8d8884b8ba---31907688801.pdfIn PDF document text
- http://www.cargeacrew.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160bbb8b77a2ec---golagewubuxopipewofib.pdfIn PDF document text
- http://www.oknookna.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160a83bfe045f1---29032240390.pdfIn PDF document text
- https://asaptransfers.co.uk/wp-content/plugins/super-forms/uploads/php/files/93uruk2s3ijl3uu38r2bcnvp02/bepufofuvezizuko.pdfIn PDF document text
- https://study-go.info/wp-content/plugins/super-forms/uploads/php/files/a0f53c7dc837c35b75b07027c2a9ff5a/26682824615.pdfIn PDF document text
- http://palazzodiaz.com/userfiles/files/41289626602.pdfIn PDF document text
- http://ohadalegistrocbarter.com/ckeditor/uploads/files/38562544996.pdfIn PDF document text
- https://rebel-guitars.com/wp-content/plugins/super-forms/uploads/php/files/cedfb036de9c1d5e6b86ae84d7e5ef6a/58578481585.pdfIn PDF document text
- https://fellowpeo.com/wp-content/plugins/super-forms/uploads/php/files/b4bd5b7cfe0288b05d4ee21b86bc93e7/89395326818.pdfIn PDF document text
- https://eliteswimmingpoolsinc.com/wp-content/plugins/super-forms/uploads/php/files/5n7r4ghujqtpl5r957dp2lith5/dugebelotegugejajuf.pdfIn PDF document text
- http://pck.malopolska.pl/wp-content/plugins/super-forms/uploads/php/files/1b474d9ebf0e1d508cf7495d5892d96b/pokunorol.pdfIn PDF document text
- https://fallsplat.se/file/rexizupuxajego.pdfIn PDF document text
- http://hzbmsj.net/images/upload/File/sejebaluke.pdfIn PDF document text
- http://raunlarose.us/wp-content/plugins/formcraft/file-upload/server/content/files/160840981bd43d---birolimudibezotilebuda.pdfIn PDF document text
- http://mirandatutoringcentre.com.au/wp-content/plugins/formcraft/file-upload/server/content/files/1608134527f50d---13059891095.pdfIn PDF document text
- http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/16076e9b7a830d---72727660370.pdfIn PDF document text
- http://urbanconstructions.org/images/uploadedimages/file/vufupakubu.pdfIn PDF document text
- http://edelstar-mos.ru/files/rapuxilalonomasivavetufo.pdfIn PDF document text
- https://lasvegasrebath.com/wp-content/plugins/super-forms/uploads/php/files/21078fb47c27abf2cd07cdad6ac7cb03/69819976354.pdfIn PDF document text
- http://www.amedna.com/userfiles/files/vasufujosukob.pdfIn PDF document text
- http://ozcetinler.com/userfiles/file/kuzebukivagobuj.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/Om9ozkHLxGw/uplcv?utm_term=how+to+change+golf+buddy+voice+2+from+meters+to+yardsPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f2b6.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF2B6 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off00010acd.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10ACD | 11540 bytes |
SHA-256: b8a51583f71d0da7ce9a38622fd17c1b660883e637cd3e18814b74f9f5e6a268 |
|||
font_02_sfnt_off000125da.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x125DA | 17380 bytes |
SHA-256: ecd99a726a72861e2e1dbdeefa5edeeb6ece91a0d843dae7bf63ce1d4bba88ec |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.