MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains numerous links pointing to compromised WordPress sites, suggesting a link farm designed to distribute malware. The ML classifier and ClamAV detection strongly indicate malicious intent. The presence of a URL with 'utm_term=kinemaster+mod+apk+2020+4k+60fps' suggests a lure for potentially unwanted or malicious software downloads.
Machine Learning
- Nyx PDF Classifier malicious score 0.9996
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://www.scmphotography.co.uk/wp-content/plugins/formcraft/file-upload/server/content/files/1608a76c7d8e2f---28438688802.pdf
- https://www.oasipizza.it/wp-content/plugins/formcraft/file-upload/server/content/files/1609ca49b46a58---vuwoto.pdf
- http://baanpowertrain.com/wp-content/plugins/formcraft/file-upload/server/content/files/1606f8810f3b88---sizasomesajunegivef.pdf
- http://vipavtoufa.ru/wp-content/plugins/super-forms/uploads/php/files/6cc166c48c45ac93761db3ae89f1a394/37308701833.pdf
- https://rockyshairsalon.com/wp-content/plugins/super-forms/uploads/php/files/ksj80uga4ih6hnt5ln236m05l7/fajatotemefod.pdf
- http://terapeutickemasaze.eu/wp-content/plugins/formcraft/file-upload/server/content/files/160a4d48c562a6---18643796051.pdf
- http://thefutureofgolf.eu/wp-content/plugins/formcraft/file-upload/server/content/files/16076c77bec46f---kemamefuxinubolibomuzorib.pdf
- http://www.1000ena.com/wp-content/plugins/formcraft/file-upload/server/content/files/16078c982b7001---93533366734.pdf
- https://mmszke.hu/files/file/xozumutotufirasutetijiten.pdf
- https://vannordenvastgoed.nl/userfiles/file/56201370821.pdf
- https://rhagro.com.mx/wp-content/plugins/super-forms/uploads/php/files/355918549173f0563f8050c54ce1363b/40596372967.pdf
- https://lllk.ru/wp-content/plugins/super-forms/uploads/php/files/6fc089651e4dec841eaa88487531db69/87006463925.pdf
- https://www.alignerco.ca/wp-content/plugins/super-forms/uploads/php/files/2787479ab5b2a98d8b7b491b88808a20/44496295873.pdf
- https://htfcompact.com/wp-content/plugins/super-forms/uploads/php/files/3146fedb6880556db94212517676d093/46346529292.pdf
- https://ipcare.nl/wp-content/plugins/super-forms/uploads/php/files/kh951lr0ucjik82pkomnoitm4j/44260434140.pdf
- https://mfdesign.hu/files/file/28505954550.pdf
- https://mindweave.co.uk/wp-content/plugins/super-forms/uploads/php/files/gg68kg0f4v2ocraou682mjnemu/nesevorasug.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://feedproxy.google.com/~r/skout/mBVl/~3/BkSY9tpko7c/uplcv?utm_term=kinemaster+mod+apk+2020+4k+60fps
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://savannah.gnu.org/projects/freefont/
- http://www.gnu.org/licenses/
- http://www.gnu.org/copyleft/gpl.html
- http://scripts.sil.org/OFL
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 5
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d638.binffeb89eaad713c9717385028f79c9757067aafb2c2382ea8cbab0e6efe35a425 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD638 | 6744 bytes |
font_01_sfnt_off0000e720.bin2a9e3286337250c88d1b510a5427f37132ca17b37850bfdb843de2770bbf6191 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE720 | 5704 bytes |
font_02_sfnt_off0000fa74.binc6f846287785a4081d0ecf0275abc791e0d6492d049b0a4b6319da9079cbae44 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFA74 | 2724 bytes |
font_03_sfnt_off0001063b.binadfce20c8bdb11bb6157c318cad4ed5108d56632224d391d480a92ab302a4a18 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1063B | 11232 bytes |
font_04_sfnt_off00012cba.bin230df8017a85ea93a5c886159708d72349b7227190d262bf2e9082262302ac19 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x12CBA | 16384 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.