MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF contains a large number of links, many pointing to compromised WordPress sites, suggesting it functions as a link farm. The ClamAV detection and ML classifier indicate malicious intent, likely to redirect users to phishing pages or download further malware. The presence of 'utm_term' parameters in some URLs further supports a campaign-like distribution strategy.
Machine Learning
- Nyx PDF Classifier malicious score 0.5474
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://irlanc.ru/uplcv?utm_term=ellipse+math+pcsi+pdf PDF link annotation
- http://stylist.in.ua/wp-content/plugins/formcraft/file-upload/server/content/files/160cb333d7cf66---57284503324.pdfIn PDF document text
- http://buergerforum-tirol.at/file/takadu.pdfIn PDF document text
- https://interesttour.com/wp-content/plugins/super-forms/uploads/php/files/e6899f23200937db9d05d6c7a19763a3/75604256532.pdfIn PDF document text
- http://hellnocancershow.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608cb89a2979f---sivefelesuwemolivekikiban.pdfIn PDF document text
- http://daglichtfilters.nl/ckfinder/userfiles/files/zixikazivopil.pdfIn PDF document text
- http://www.alcera.ca/userfiles/file/26295588141.pdfIn PDF document text
- http://www.stockholmswingallstars.com/wp-content/plugins/formcraft/file-upload/server/content/files/160907d6b30c1e---24698579631.pdfIn PDF document text
- http://france-ex.com/14402946895.pdfIn PDF document text
- https://fjordancv.info/wp-content/plugins/super-forms/uploads/php/files/d6b8f0ca9798de1b165f0e207287d136/85379322231.pdfIn PDF document text
- https://spencershaulageltd.co.uk/wp-content/plugins/super-forms/uploads/php/files/ffd53ef1e6ec13bc512bcd5f9780879a/85654502920.pdfIn PDF document text
- https://kungfuclasshongkong.com/louis/taichi/ckfinder/userfiles/files/gibafotoxapomuneb.pdfIn PDF document text
- https://horizontire.com/userfiles/file/57690891713.pdfIn PDF document text
- http://www.trotasierra.com/plugins/ckfinder/userfiles/files/16677162838.pdfIn PDF document text
- http://hanasushimenifee.com/uploads/files/20932030323.pdfIn PDF document text
- https://ocvirapuato.com.mx/wp-content/plugins/super-forms/uploads/php/files/f9c91878b7522d42aa09c9e7aba00014/nemukirasebefowibanikaf.pdfIn PDF document text
- https://creationstationdance.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bb5aa61e751---gixaforowovojugukozodi.pdfIn PDF document text
- https://www.3dreamchurch.com/wp-content/plugins/super-forms/uploads/php/files/0bcffc77bd4d506b6ee9e5150859e2ba/3284148808.pdfIn PDF document text
- http://tsradviseurs.nl/mailing/images/photo/file/42313904385.pdfIn PDF document text
- http://gtlmarinefuel.com/userfiles/file/rutopiviramulexuxeba.pdfIn PDF document text
- http://ljhalls.com/wp-content/plugins/super-forms/uploads/php/files/b81eefee8157ae73846651209c118c52/rumekowekaxijejo.pdfIn PDF document text
- http://live-net.it/file/babizelanob.pdfIn PDF document text
- http://www.etoiles-recrutement.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609e75bf29745---32329668702.pdfIn PDF document text
- https://maidintown.co.uk/wp-content/plugins/super-forms/uploads/php/files/ccf7de4facbf9ee6b5f64b6dc00119aa/liratemelusoje.pdfIn PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e44b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE44B | 10544 bytes |
SHA-256: cbc1c7ba45884b1d4d0e529734680f67cdbf754379e551828519e3117bf3aa69 |
|||
font_01_sfnt_off0000fc4b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFC4B | 17832 bytes |
SHA-256: e0a980106a9d6e81b4c496374ab846ced9f251c20df9660c9d24bc2edf9fa965 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.