MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1203 Exploitation for Client Execution
This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It functions as a link farm, with numerous URLs pointing to compromised WordPress sites, likely to host or redirect to malicious content. The presence of multiple PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM and PDF_SEO_DISPOSABLE_LINK_FARM heuristics further supports this attack pattern.
Machine Learning
- Nyx PDF Classifier malicious score 0.9946
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://qboardapp.com/wp-content/plugins/super-forms/uploads/php/files/50984e1e13f0d0bf2c6f34db284a17d3/debiruxidokoginimazu.pdf In PDF document text
- https://www.helpagesl.org/wp-content/plugins/formcraft/file-upload/server/content/files/160b623ae18eb2---luxowawa.pdfIn PDF document text
- https://bharatbiodiesel.com/userfiles/file/11672665828.pdfIn PDF document text
- http://lbs.ac.at/wp-content/plugins/super-forms/uploads/php/files/bcad0llhrldd2bclsiuu05hsb7/667348189.pdfIn PDF document text
- https://bloomlight.pl/_bloom/file/porux.pdfIn PDF document text
- http://totaleclipsenv.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c3ed2ad6ef6---28263795442.pdfIn PDF document text
- https://kfz-gutachter-oliver-schiller.de/wp-content/plugins/formcraft/file-upload/server/content/files/16081620b62f09---wewuzekesaruvukabumu.pdfIn PDF document text
- https://www.cibaospalaser.com/wp-content/plugins/super-forms/uploads/php/files/e962va1ct5c35qpjph85kiffi1/79169981090.pdfIn PDF document text
- https://dermo.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609834da7d0d1---13776867454.pdfIn PDF document text
- https://vakukh.ru/wp-content/plugins/super-forms/uploads/php/files/db7d814873adbe6ac2aa9e54ed2d8620/gizufevosidikubexo.pdfIn PDF document text
- http://ahzycw.com/upload_fck/file/2021-7-29/20210729173610827675.pdfIn PDF document text
- http://www.bandungmesin.com/file/13546509486.pdfIn PDF document text
- http://www.stratcareerservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16098425bdde81---popogigurejiretujuposuso.pdfIn PDF document text
- https://www.davidcosz.de/wp-content/plugins/super-forms/uploads/php/files/b9phn71ddnvcme974l6qhpsofa/3507437151.pdfIn PDF document text
- http://www.marcado.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160dec930cccfd---wulibuwaxotukivowotinexu.pdfIn PDF document text
- http://simonhoirup.dk/userfiles/file/85907286353.pdfIn PDF document text
- http://www.qookspot.kitchen/wp-content/plugins/formcraft/file-upload/server/content/files/160b36dcda176a---29159916560.pdfIn PDF document text
- http://getawaynewzealand.co.nz/wp-content/plugins/formcraft/file-upload/server/content/files/16132c20ead549---sibameta.pdfIn PDF document text
- https://asigurareingermania.ro/wp-content/plugins/super-forms/uploads/php/files/0nmrnm02kcn2ubse7qpvt1cdl4/sorujarowowajo.pdfIn PDF document text
- https://www.scanworld.se/wp-content/plugins/formcraft/file-upload/server/content/files/1607d0c0341b93---tumuturofifisizipebikapil.pdfIn PDF document text
- http://africa-emergence2019.com/userfiles/file/35458782579.pdfIn PDF document text
- http://njxinbell.com/upload/files/1070034044.pdfIn PDF document text
- http://www.restorationservice.ca/wp-content/plugins/formcraft/file-upload/server/content/files/1608cfd2ac4f3f---zuzapi.pdfIn PDF document text
- https://certifiedmoversinc.com/wp-content/plugins/super-forms/uploads/php/files/873655c8d0704ffa9e86891843afa846/ditul.pdfIn PDF document text
- http://sbnjl.com/userfiles/files/51122483133.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/YTWXjIUwRh0/uplcv?utm_term=asbabun+nuzul+pdf+bahasa+indonesiaPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d58b.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD58B | 21480 bytes |
SHA-256: ba77f7565ceaed78e4f2f9503ac19da4130623a1746e3606a29de8b15a893a46 |
|||
font_01_sfnt_off00010da8.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10DA8 | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_02_sfnt_off000125bf.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x125BF | 10676 bytes |
SHA-256: 7059d9967ca7075c88f28cb05bb9f00aaaa99555afe870369b8ef08c630bb953 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.