MALICIOUS
206
Risk Score
Machine Learning
- Nyx PDF Classifier malicious score 0.5759
Heuristics 7
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINKPDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
-
Browser extension / update installation lure high SE_BROWSER_INSTALL_LUREDocument tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://fecuq.co.za/XSRYdR1H?utm_term=google+chrome+group+policy+template+admx PDF link annotation
- https://dedywiredja.com/wp-content/plugins/formcraft/file-upload/server/content/files/161170d00a03b5---ganopebadipivudelufepa.pdfIn PDF document text
- http://nwatchonline.org/userfiles/file/81466124640.pdfIn PDF document text
- http://www.deep2001.com/images/library/File/muwonejeman.pdfIn PDF document text
- http://witnesstherealist.com/wp-content/plugins/super-forms/uploads/php/files/da0734a3c20b65affab60caaa9a26aa3/sesimisobuwawegaruxa.pdfIn PDF document text
- https://condominiovillage.com/userfiles/file/subujowad.pdfIn PDF document text
- https://georeno.ca/userfiles/files/38341865157.pdfIn PDF document text
- http://etenindex.nl/images/uploads/71509205947.pdfIn PDF document text
- http://comicpapyrus.com/wp-content/plugins/super-forms/uploads/php/files/765d80a58949e847026b6ac8f92569e1/fepoxejiromolovip.pdfIn PDF document text
- https://tortugafilms.ca/adminfiles/file/10131501056.pdfIn PDF document text
- https://acconpriti.com/ckfinder/userfiles/files/xemubomigu.pdfIn PDF document text
- https://spazmedia.com/wp-content/plugins/formcraft/file-upload/server/content/files/161c1238069dfd---sepuvijometunetewurul.pdfIn PDF document text
- https://sogelec-eng.com/files/ckfinder/files/zewon.pdfIn PDF document text
- https://traiteur-troyes-mariage-buffet-aube-10.blaisot-traiteur.fr/ckfinder/userfiles/files/72905329102.pdfIn PDF document text
- https://sogelec-eng.com/files/ckfinder/files/86305201790.pdfIn PDF document text
- https://medicraftindia.com/uploads/file/tanipilifodapej.pdfIn PDF document text
- https://fa-vietnam.com/webroot/img/files/fakubudegasubake.pdfIn PDF document text
- https://assignmentmart.com/ckfinder/userfiles/files/52488521590.pdfIn PDF document text
- http://zeci.nl/im/image/85156184442.pdfIn PDF document text
- https://atcotourismtravel.com/userfiles/file/22874617218.pdfIn PDF document text
- http://autosvanbeek.nl/mindcms/js/ckf/userfiles/files/rumenotura.pdfIn PDF document text
- http://modernplating.com/userfiles/file/tewefatufurofopapumugosew.pdfIn PDF document text
- http://idcla.net/upload/files/didav.pdfIn PDF document text
- https://www.oeg.co.th/template/backoffice/plugins/kcfinder/upload/files/%E0%B8%82%E0%B9%89%E0%B8%AD%E0%B8%A1%E0%B8%B9%E0%B8%A5%E0%B9%80%E0%B8%9A%E0%B8%B7%E0%B9%89%E0%B8%AD%E0%B8%87%E0%B8%95%E0%B9%89%E0%B8%99%E0%B9%82%E0%B8%84%E0%B8%A3%E0%B8%87%E0%B8%81%E0%B8%B2%E0%B8%A3%20OEG%20Teach%20in%20Thailand%202020.pdfIn PDF document text
- https://wupaojichangjia.com/d/files/84003142853.pdfIn PDF document text
- http://effektfilm.de/files/file/22719603814.pdfIn PDF document text
- http://saydersan.com/firma/files/62194704732.pdfIn PDF document text
- https://mtydizayn.com/userfiles/file/41707348070.pdfIn PDF document text
- http://chickenwild.com/upload/contents/images/images/burudiduravozorefob.pdfIn PDF document text
- http://www.whirlpool-beachcomber.at/wp-content/plugins/formcraft/file-upload/server/content/files/16150e544ec863---43174910290.pdfIn PDF document text
- https://nrsa.tj/nrsa_system/ckeditor/kcfinder/upload/files/mularujuxuxodafobeba.pdfIn PDF document text
- http://ats-dz.com/userfiles/file/wobufiso.pdfIn PDF document text
- https://www.skyline-recruiting.com/wp-content/plugins/super-forms/uploads/php/files/394ab5a31f8769789e503ee7490599bc/9480828927.pdfIn PDF document text
- http://www.crislbd.com/public/admin/assets/ckeditor/kcfinder/upload/files/30789168557.pdfIn PDF document text
- http://ckattorneys.net/customer/3/d/9/3d947ad6ce2568d98b832ccf5548371bFile/bukegawopusoze.pdfIn PDF document text
- http://zerosquareonline.com/file/lised.pdfIn PDF document text
- https://clifestyle.net/uploades/userfiles/file/fozovudozezubur.pdfIn PDF document text
- http://matchonusa.com/uploads/files/74804696608.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn extracted file (font_00_sfnt_off000389d3.bin)
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn extracted file (font_00_sfnt_off000389d3.bin)
Extracted artifacts 4
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000389d3.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x389D3 | 11044 bytes |
SHA-256: 4ba32a98728fb143c710bb989595bae43db4af212d549ca6475c3353eaf52139 |
|||
font_01_sfnt_off0003a35f.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3A35F | 1796 bytes |
SHA-256: 755b843c3a20f66ea68988c6c55ef5c5be5f59bb004e03bff28a6134c7f942e8 |
|||
font_02_sfnt_off0003abca.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3ABCA | 19352 bytes |
SHA-256: f0f9ea48ded06043fd54f3721fa7497b6d89a00b60fd6634dabf9ca77f43fef1 |
|||
font_03_sfnt_off0003de0e.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x3DE0E | 16560 bytes |
SHA-256: 924ad5cb737cfd9a34472b2046831991df4d3950e5f0d7b552a18309318c2ee9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.