MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
The PDF contains numerous links to compromised websites, indicating it functions as a link farm. The ClamAV detection and ML classifier strongly suggest malicious intent, likely for phishing or distributing further malware. The presence of multiple compromised CMS upload links points to a technique used to host malicious files.
Machine Learning
- Nyx PDF Classifier malicious score 0.9942
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://bajajsports.com/userfiles/file/munipemiwi.pdf
- https://stellabakingcompany.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b610af03e51---97885984189.pdf
- https://misionesmedellin2030.com/wp-content/plugins/super-forms/uploads/php/files/40ifcqc6hcjb5helfp8rs7u03c/98759186912.pdf
- http://assushop.com/userfiles/assushop.com/file/kigepibugavofisixunux.pdf
- https://ercrs.org/wp-content/plugins/super-forms/uploads/php/files/gj3pnu9csrsun5k5qvvui8gcrh/wezoxosexotoxipesemibu.pdf
- https://www.ikedatosou.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607a2846d9b11---wigibukujuvemajulodo.pdf
- http://dirabrealtors.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609b6b4ac97e2---xutuxef.pdf
- http://birons.net/wp-content/plugins/super-forms/uploads/php/files/fa0511a61d6eb64132fb512eebaa0f1c/ruzexevovodetum.pdf
- http://gongotour.com/FileData/ckfinder/files/20210608_6079D3CF53E54C2B.pdf
- https://cbolean.com/wp-content/plugins/super-forms/uploads/php/files/41bd18de65876d1b7851e34526a47248/49758860585.pdf
- https://bizdrive.nl/wp-content/plugins/formcraft/file-upload/server/content/files/1/160aec20e81408---tipipewivavube.pdf
- http://mulherinscampground.com/clients/879992/File/jibiduwav.pdf
- https://drivingschoolofnorthtexas.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606d142ca135c---57351165652.pdf
- http://grupogmec.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083b56711ac1---10256154692.pdf
- http://ruoumoc.com/upload/files/rogejuzubavezemal.pdf
- https://www.chinacimctrailer.com/wp-content/plugins/super-forms/uploads/php/files/d8ed35b022c384e7869d735c62e54512/fameribelajataz.pdf
- http://kingspec.su/wp-content/plugins/super-forms/uploads/php/files/dp00jgi291jmddtaoegan1m7iv/gerubisenewilidi.pdf
- https://infypos.com/infyposcms/media/50701619159.pdf
- https://www.aironface.com/wp-content/plugins/super-forms/uploads/php/files/f36f244d6535c24037b3f53f6b1296c6/zipefimeritivisalazu.pdf
- https://jmtours.co/aym_image/files/90469820475.pdf
- http://bdn10.cz/files/file/16367121517.pdf
- http://ipmarketing.net/userfiles/file/17359875847.pdf
- http://cephedanismani.com/images/pages/file/nilowufovivoxojuvi.pdf
- https://vuaship.com/wp-content/plugins/super-forms/uploads/php/files/ccngu52qpfa9uk193bvjif9h1l/wujodenelezurawavexaravav.pdf
- https://cms.blauraum.com/wp-content/plugins/super-forms/uploads/php/files/342b6b34212938b32a4cb2bc7dec2f27/pelofalojivik.pdf
- https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=calculate+your+body+mass+index
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f29a.bina17ed555b4016fc7c6106c94b504847ddde094d9af4749a160c44c4b17905374 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF29A | 11016 bytes |
font_01_sfnt_off00010c42.bina2ab88e4ddf528e672d5fc94c780b838275ff91d95003076724d7bbaa5091436 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10C42 | 16936 bytes |
font_02_sfnt_off0001386d.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1386D | 16792 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.