MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file was detected as a phishing trojan by ClamAV. Static analysis revealed it functions as a link farm, hosting numerous URLs on potentially compromised CMS uploads and disposable domains. These links likely lead to phishing pages or further malware downloads.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3778
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://sportnazona.bg/f/uploads/files/tobuzixaguk.pdf In PDF document text
- http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/160af24f827907---26482696456.pdfIn PDF document text
- http://trendymamy.pl/userfiles/file/levukafunedezisokebowupo.pdfIn PDF document text
- https://agribusiness.pk/wp-content/plugins/formcraft/file-upload/server/content/files/1608ce8c2ae9db---kamadinovuburipemidafa.pdfIn PDF document text
- http://leadershipcareer.kr/fckeditor/_upload/file/binukufunuxalazemaku.pdfIn PDF document text
- http://erkerlaender.de/wp-content/plugins/formcraft/file-upload/server/content/files/160de96b32c1c5---46350997990.pdfIn PDF document text
- https://247hvac.ca/fabulous1/uploads/files/81767267788.pdfIn PDF document text
- http://www.jesuseslaroca.org/wp-content/plugins/formcraft/file-upload/server/content/files/16098308d07234---13894079605.pdfIn PDF document text
- http://stkvn.ru/wp-content/plugins/super-forms/uploads/php/files/1552c6e158a1a057b4b337a9960163ea/vifipivipubixevekaga.pdfIn PDF document text
- http://www.iycadana.org/wp-content/plugins/super-forms/uploads/php/files/844oqr1a1fk0mjcis2im4btit5/werugikururoselaf.pdfIn PDF document text
- http://www.orarestauratorisaf.it/wp-content/plugins/formcraft/file-upload/server/content/files/160a49999d356c---kepowovamuletosafepi.pdfIn PDF document text
- http://dok-vo.ru/userfiles/file/sonagab.pdfIn PDF document text
- https://www.budgetskemaet.dk/wp-content/plugins/formcraft/file-upload/server/content/files/16096d3d19a118---75826418113.pdfIn PDF document text
- http://www.startservis.sk/novy/ckfinder/userfiles/files/bufufufopamupipesotaxeret.pdfIn PDF document text
- http://elonsummerstorage.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607c239363fb2---17263883680.pdfIn PDF document text
- http://paymentsbusiness.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1609866d5dc987---74638550053.pdfIn PDF document text
- http://www.garriagricola.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ae3d39c0715---52620361374.pdfIn PDF document text
- http://chouchoudauphongongtay.com/upload/ck/files/visuderavigovixobedezal.pdfIn PDF document text
- http://ardechetendancebrut.fr/userfiles/ardechetendancebrut.fr/file/sezaboluj.pdfIn PDF document text
- http://actionelectric.pt/www/wp-content/plugins/formcraft/file-upload/server/content/files/1609c8f21bf520---95938802820.pdfIn PDF document text
- http://ucity68.com/clients/e/ea/ea220da86df44fb0ae3b7c8e8295ccc1/File/zadabibanafeser.pdfIn PDF document text
- http://www.canadavisaservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609c607f98584---2150709825.pdfIn PDF document text
- https://avantkart.com/wp-content/plugins/super-forms/uploads/php/files/4j3q1qiops6aet35prhvnj1d8l/mokeretofasoduwilemomisa.pdfIn PDF document text
- https://almondzwealth.com/administrator/imagetemp/file/8790859223.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=french+verbs+starting+with+cPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00010ab5.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10AB5 | 10612 bytes |
SHA-256: 65575401d245edb21ed4670aaab9d1f152193429377c140d6a325c081ea7d562 |
|||
font_01_sfnt_off000122fa.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x122FA | 18656 bytes |
SHA-256: 6619319ee7a79123223d59d0768c0e0bfaae4020fcd784c2f6df67beb2c4c1b4 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.