MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file is identified as malicious by ClamAV with a "Pdf.Phishing.Trojan" signature. It contains numerous embedded URLs, many pointing to compromised WordPress sites and disposable hosting, suggesting a link farm designed to redirect users to malicious content. The document body, though heavily obfuscated, contains text related to "Gujcet 2017 biology paper", indicating a lure to entice users to click on the embedded links.
Machine Learning
- Nyx PDF Classifier suspicious score 0.2847
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://wastran.ru/uplcv?utm_term=gujcet+2017+biology+paper PDF link annotation
- https://homini.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160bd84f69ebbc---febuxeko.pdfIn PDF document text
- http://4bx.pl/public/file/xojuxezujixa.pdfIn PDF document text
- http://bilagroup.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083040f691c1---jedirubijasogipur.pdfIn PDF document text
- http://haithuanphat.com/uploads/files/21459219036.pdfIn PDF document text
- http://fusheng-vietnam.vn/admin/webroot/upload/image/files/38777933716.pdfIn PDF document text
- https://homini.eu/wp-content/plugins/formcraft/file-upload/server/content/files/1606f215378eda---88746439315.pdfIn PDF document text
- http://cedresarquitectura.com/wp-content/plugins/formcraft/file-upload/server/content/files/16088672b89e23---jamukaxupanilijipa.pdfIn PDF document text
- https://remoteworkerclub.com/wp-content/plugins/super-forms/uploads/php/files/f6c3135082364a0b4fc78c4bd926738c/87711126395.pdfIn PDF document text
- https://cffcommunications.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/16084a832c13c2---86870733084.pdfIn PDF document text
- https://blueridgelightingandcontrols.com/wp-content/plugins/super-forms/uploads/php/files/6d6e653a19cd19d39266ff00e4420fd6/75705693742.pdfIn PDF document text
- https://joyfool.art/wp-content/plugins/super-forms/uploads/php/files/4441ced1284d971da3a71937bcbfbfa4/6887093744.pdfIn PDF document text
- http://anthonyvienna.com/sites/default/files/file/jamoniwugalafunejibegoz.pdfIn PDF document text
- https://www.mercedesbenzofaustinservice.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a027e00ea96---17351733053.pdfIn PDF document text
- https://wpsqld.com.au/wp-content/plugins/super-forms/uploads/php/files/3f2cf0715d6fb08022405043cd5ed77d/pefaxetazisimifiruvipis.pdfIn PDF document text
- http://endustriyelkiralama.com/wp-content/plugins/super-forms/uploads/php/files/pcm9ed02k8vkoo2c5n3n2m0840/biroraxegulejoruni.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.indictrans.orgIn PDF document text
- http://scripts.sil.org/OFLIn PDF document text
- http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
- http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e503.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE503 | 5676 bytes |
SHA-256: 495ab37398f9b7a6d2ba0b04e2b50323c7b0a81f2ec62b1f019424024f650efa |
|||
font_01_sfnt_off0000f887.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF887 | 3720 bytes |
SHA-256: d5ecec3e822993868ba70e247019bcdb656a9fee58d620eb93bc70658e929280 |
|||
font_02_sfnt_off000103e2.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x103E2 | 1936 bytes |
SHA-256: 73983ccd477f0e4c07634362c0f9f13a23cea415a26bff37f7f125d59a681190 |
|||
font_03_sfnt_off00010d24.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D24 | 10084 bytes |
SHA-256: f94fea5e9cd98c0367fcaa5627884e3c109bd6a64c65d3c1ac9afe240e2adbf6 |
|||
font_04_sfnt_off00012dae.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12DAE | 11268 bytes |
SHA-256: 66bfe499e00525e498004eac7f177f081ee63ec8853e393c42fd69399a98b764 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.