MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
The PDF file contains numerous embedded URLs that point to other PDF files hosted on various domains. Several heuristics indicate this is a link farm, with some links pointing to compromised WordPress upload directories. The ClamAV detection as 'Pdf.Phishing.Trojan' strongly suggests a malicious intent, likely to lure users into downloading further malicious content or engaging in phishing activities.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4703
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://krisoc.ru/uplcv?utm_term=meaning+of+reinstated+in+english PDF link annotation
- http://mastervin.ru/files/file/ritaxesez.pdfIn PDF document text
- http://yao-cheng.com/uploadfiles/20210919041623.pdfIn PDF document text
- https://abss.pt/userfiles/file/sorofimidoludafupejer.pdfIn PDF document text
- http://aow.infogestnet.it/ckfinder/userfiles/files/domokosesezumijukitowaxej.pdfIn PDF document text
- https://nailseasupportgroup.com/wp-content/plugins/super-forms/uploads/php/files/ef4532c739c86dbb5ecad6e050b2c748/93689656045.pdfIn PDF document text
- http://zamgph.com/uploads/file/230750228694.pdfIn PDF document text
- https://hamasataccessories.com/userfiles/files/gilirimexavo.pdfIn PDF document text
- https://marsanz.pl/uploads/fck/file/66572356376.pdfIn PDF document text
- http://supermarketdv.ru/files/file/filikak.pdfIn PDF document text
- http://interwork.sk/userfiles/file/71210494297.pdfIn PDF document text
- https://sharzh-ufa.ru/wp-content/plugins/super-forms/uploads/php/files/310f182e1ec8ab763816e31a8c453a58/94436807030.pdfIn PDF document text
- https://www.bocamvigliesrooms.com/wp-content/plugins/super-forms/uploads/php/files/bec7033d00d1909b8ece98e64d3ad791/20806218865.pdfIn PDF document text
- http://mestan.by/images/file/zuniw.pdfIn PDF document text
- https://pvcmikser.com/upload/files/numunepinibejebidi.pdfIn PDF document text
- https://www.lsv-wittlage.de/ckfinder/userfiles/files/73405930459.pdfIn PDF document text
- https://clicksnepal.grnca.org/img/files/files/7512535248.pdfIn PDF document text
- https://maxlinder.com/admin/assets/ckfinder/userfiles/files/4527013912.pdfIn PDF document text
- http://www.nationaalgolfcongres.nl/wp-content/plugins/formcraft/file-upload/server/content/files/161534a205f203---sivijum.pdfIn PDF document text
- https://o2opr.co/userfiles/files/sogizivijoxakozaseviv.pdfIn PDF document text
- http://irinabailey.com/upload/files/ximesapuwupijeromixowoge.pdfIn PDF document text
- https://voicelux.ru/wp-content/plugins/super-forms/uploads/php/files/11247e0afe3d5b315883423ce26d86ac/1260203076.pdfIn PDF document text
- http://ambvet-trefontane.eu/userfiles/files/16658524273.pdfIn PDF document text
- https://ww150005.linebot.net/upfile/files/20210908192902.pdfIn PDF document text
- http://zatexpress.com/upload/userfiles/files/faripos.pdfIn PDF document text
- https://www.autopsrus.com/ckfinder/userfiles/files/pifuge.pdfIn PDF document text
- http://ctyrkolky-gamax.cz/data/dokumenty/fafetedupoge.pdfIn PDF document text
Open this report in the interactive analyzer, or submit your own file for analysis.