MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file contains numerous links to external websites, many of which are hosted on compromised CMS platforms or disposable domains, indicating a link farm designed to redirect users. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a phishing or malware distribution intent. Although no scripts were explicitly extracted, the PDF structure and extensive URL usage point towards a malicious document, likely delivered as a spearphishing attachment.
Machine Learning
- Nyx PDF Classifier clean score 0.1831
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://catamma.ru/uplcv?utm_term=space+time+continuum+pdf PDF link annotation
- http://nhs71.com/clients/d/d9/d9c6bfbc4bbdd207836d30c01fe5869c/File/vetidazusifimap.pdfIn PDF document text
- https://celovechurch.org/wp-content/plugins/super-forms/uploads/php/files/f6bf1129ca66e1d937b7a080e6b5ba65/sonogukunezazedapogupaniz.pdfIn PDF document text
- https://www.teppiche-waschen-hamburg.de/wp-content/plugins/formcraft/file-upload/server/content/files/161118b5356613---76867164977.pdfIn PDF document text
- http://andrelandberg.com/userfiles/file/4917436199.pdfIn PDF document text
- http://baanpowertrain.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607365c1482fe---nililutijamur.pdfIn PDF document text
- https://www.davidcosz.de/wp-content/plugins/super-forms/uploads/php/files/5i0hlas46ae41m28g32imc9pqb/13436452003.pdfIn PDF document text
- http://www.skup.it/wp-content/plugins/formcraft/file-upload/server/content/files/1606dce8de9090---88947673431.pdfIn PDF document text
- https://championsforchildren.org/wp-content/plugins/super-forms/uploads/php/files/2580ae19dcf14fa9f7d8c7e6e2432870/18087735832.pdfIn PDF document text
- http://fullcolorspandoeken.nl/userfiles/file/87121862056.pdfIn PDF document text
- http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160bbe02ee43d4---35674465918.pdfIn PDF document text
- http://trainternational.in/wp-content/plugins/formcraft/file-upload/server/content/files/1611a73753cc47---pitelibetovajisev.pdfIn PDF document text
- http://littlefreddieking.com/clients/65037/File/rugiwubomesivigikojuko.pdfIn PDF document text
- http://luckyassessoria.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/160a58f60c4a07---93228102851.pdfIn PDF document text
- https://www.tai.gr/wp-content/plugins/formcraft/file-upload/server/content/files/160f17a5dba186---dovat.pdfIn PDF document text
- http://www.pirac.org/wp-content/plugins/super-forms/uploads/php/files/312db6e1768eb5f4873d69c3c77a6853/85301230243.pdfIn PDF document text
- https://cald-lighting.com/wp-content/plugins/super-forms/uploads/php/files/e3b8be3122b02b9c4c92634d066afad3/pekas.pdfIn PDF document text
- http://www.investing-in-women.com/wp-content/plugins/formcraft/file-upload/server/content/files/1612528214ff37---79558690639.pdfIn PDF document text
- http://gingerwooddesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088a7888ffae---1146955701.pdfIn PDF document text
- https://eyetracking.pl/userfiles/file/doniduxinubirikugob.pdfIn PDF document text
- http://uniradioweb.info/userfiles/files/81991856637.pdfIn PDF document text
- https://mashura.co/userfiles/files/muwojadeluxixutekevenem.pdfIn PDF document text
- http://chothuexehochiminh.com/userfiles/file/51763509997.pdfIn PDF document text
- https://robertmatzuzi-massagetherapist.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/160b3ef8984db4---fotovifiriputidobowo.pdfIn PDF document text
- http://agcslohian.com/userfiles/file/54652297224.pdfIn PDF document text
- http://polyalpan.hu/_user/file/puzemapikuxiponovujo.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000ffd9.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFFD9 | 10640 bytes |
SHA-256: c1c1a3b8900a0d59afc3904cb2f0a34ab6514b1406ea826f9778f269088ec503 |
|||
font_01_sfnt_off0001183a.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1183A | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.