MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file was detected as a phishing trojan by ClamAV. Static analysis revealed it functions as a link farm, directing users to multiple compromised WordPress upload directories and disposable hosting sites. The embedded URLs, such as the one pointing to a compromised WordPress plugin, are likely intended to host malicious payloads or redirect to phishing pages.
Machine Learning
- Nyx PDF Classifier suspicious score 0.3778
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://psychotherapie-dr-albrecht.de/wp-content/plugins/formcraft/file-upload/server/content/files/1606f5f2fd9473---ponulirilesilazokejanitas.pdf In PDF document text
- https://mattweidnerlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160748bf167bab---4868790457.pdfIn PDF document text
- https://bakwanudang.com/contents//files/68311189796.pdfIn PDF document text
- http://cnhhgj.com/upfiles/userfiles/file/womutezenipigorap.pdfIn PDF document text
- http://www.lauricedale.co.za/wp-content/plugins/formcraft/file-upload/server/content/files/1607cc78753c38---80818295496.pdfIn PDF document text
- http://drukarnia-skawina.pl/app/webroot/media/files/fipuravowubefa.pdfIn PDF document text
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16083fe8597f0b---duremakexik.pdfIn PDF document text
- http://sunrui-ti.com/d/files/25606974877.pdfIn PDF document text
- http://www.irrv.org/uploads/files/lifitijosetow.pdfIn PDF document text
- http://www.catalogodecineargentino.com/wp-content/plugins/formcraft/file-upload/server/content/files/160983ef3131d8---bolilij.pdfIn PDF document text
- https://roadtoring.com/wp-content/plugins/super-forms/uploads/php/files/1c5d074670c6a0c2c743fd942c6d49a0/29121403174.pdfIn PDF document text
- https://alquimia.in/admin/fckeditor/editorfile/jakabemexak.pdfIn PDF document text
- http://www.marcelasemper.com/wp-content/plugins/formcraft/file-upload/server/content/files/160b6abf6a6704---76956421128.pdfIn PDF document text
- https://selectwifi.com/wp-content/plugins/formcraft/file-upload/server/content/files/160bc6a91ab8e9---lorusewuzadodoxajilogebe.pdfIn PDF document text
- https://parisautotravel.com/wp-content/plugins/super-forms/uploads/php/files/7gkldok7q7f9r7shc2jkl00bm7/28945423294.pdfIn PDF document text
- http://nappsa.org/userfiles/file/sagodi.pdfIn PDF document text
- http://bettekingproductions.com/clients/874300/File/magojobasarevus.pdfIn PDF document text
- http://mko-yug.ru/wp-content/plugins/super-forms/uploads/php/files/08c03c972e8ae89ebeea11f7de814b97/kapapofegobakevowagur.pdfIn PDF document text
- http://jessicarossitto.com/clients/7/7c/7c16b8c799dae9ffcd1258f31d6ff645/File/jopafovisebuwewizofo.pdfIn PDF document text
- http://kjphotocon.org/data/userfiles/files/74430106382.pdfIn PDF document text
- https://gmonlinestore.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f7df02ad74---sanigigozedev.pdfIn PDF document text
- http://www.sunarsurdurulebilir.com/wp-content/plugins/super-forms/uploads/php/files/pougf5l2m16v4q52s5ijir00v3/88431137553.pdfIn PDF document text
- http://www.cuadernos.in/wp-content/plugins/formcraft/file-upload/server/content/files/16081d31fcff10---papenamibumofewofu.pdfIn PDF document text
- https://feedproxy.google.com/~r/Uplcv/~3/3vuEKuznOb8/uplcv?utm_term=connectify+license+keyPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f768.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF768 | 17492 bytes |
SHA-256: 4acd93c544187bd95c9d9fcbdf1bb9e30294696d91811a6be55e81571f0ca023 |
|||
font_01_sfnt_off00012556.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12556 | 10304 bytes |
SHA-256: 73417343588705dc4590b55d5b26372b8b2d02b1d70d086edf0f67fad7031fed |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.