MALICIOUS
154
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF document was flagged by ClamAV as Pdf.Phishing.Trojan and by an ML classifier as malicious. It contains a link farm with numerous URLs pointing to PDF files hosted on compromised WordPress sites, suggesting a phishing or malware distribution attempt. No scripts were extracted from this sample, but the structure and embedded URLs indicate a malicious intent to redirect users to potentially harmful content.
Machine Learning
- Nyx PDF Classifier malicious score 0.5411
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://asbazainville.org/userfiles/file/86404483551.pdf In PDF document text
- http://www.chicagoalphas.com/wp-content/plugins/formcraft/file-upload/server/content/files/16073e954aee37---84468519488.pdfIn PDF document text
- http://pn-tech.net/userData/board/file/91723612530.pdfIn PDF document text
- https://alakharia.com/public_html/userfiles/file/favixidepupodebus.pdfIn PDF document text
- http://hibertek.com/image/files/20210629_083135.pdfIn PDF document text
- http://plenar.hr/wp-content/plugins/formcraft/file-upload/server/content/files/160c2133c22661---5384422863.pdfIn PDF document text
- https://agilitynd.com/wp-content/plugins/super-forms/uploads/php/files/71ffe8e39c5e533dacec8ebbba71c92e/46753441575.pdfIn PDF document text
- https://klingende-zeder.de/wp-content/plugins/formcraft/file-upload/server/content/files/160a0374a22d2f---voruxijikuxewafufofaz.pdfIn PDF document text
- http://anonelectronics.com/admin/fckeditor/editor/filemanager/connectors/php/upload_jpg/file/202105280702192281.pdfIn PDF document text
- https://www.modianodesign.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607dbf9fa6217---30179673754.pdfIn PDF document text
- http://infrabud.eu/fckpliki/file/zafudejuvogumobugiligiwe.pdfIn PDF document text
- http://www.hptindia.com/wp-content/plugins/formcraft/file-upload/server/content/files/16086a63c2dd13---90330346894.pdfIn PDF document text
- https://afd.me.uk/wp-content/plugins/super-forms/uploads/php/files/utqps0jjudvvmg4mk733hmuu7f/dofoxis.pdfIn PDF document text
- https://joepromenshealth.com/wp-content/plugins/super-forms/uploads/php/files/e04d3ea2af9e7fa0a381d79499d18c0b/5949420153.pdfIn PDF document text
- http://kusadasidentalclinic.com/img/userfiles/files/904840133.pdfIn PDF document text
- http://master-br.ru/img/file/44723748059.pdfIn PDF document text
- http://smartmedicaleg.com/wp-content/plugins/formcraft/file-upload/server/content/files/160731133d3cd2---29187912230.pdfIn PDF document text
- http://skomi.ru/img/files/file/vajoduxafedixip.pdfIn PDF document text
- http://agriturismolataggiasca.eu/userfiles/files/45414751697.pdfIn PDF document text
- https://k9-warrior.com/wp-content/plugins/super-forms/uploads/php/files/gtch943b0hvsipvqijvisb35li/46698182883.pdfIn PDF document text
- http://kreativitaet-stadlhofer.at/global/images/userfiles/file/32377992285.pdfIn PDF document text
- http://christembassydocklands.org/wp-content/plugins/super-forms/uploads/php/files/56762314fcb19408adc1102f8922a13d/wokamukavopu.pdfIn PDF document text
- http://kientrucnhacuagio.com/upload/files/15224079877.pdfIn PDF document text
- http://www.mvdisposal.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608717f6134a5---vukatup.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/GLLx1DTH0VQ/uplcv?utm_term=add+pokecord+bot+to+discordPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d8e4.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD8E4 | 16396 bytes |
SHA-256: 318bfac56918f059623290e27d7f705af2f3b4346c1d30ae8f8c8052817d2ce1 |
|||
font_01_sfnt_off0000ef60.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEF60 | 18176 bytes |
SHA-256: 92c8d9abab0954c95edd018aa62fe6c6fc8d8d51f4df587f53a45013a60cb684 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.