MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The document contains numerous embedded URLs, many of which point to compromised WordPress sites or disposable hosting, suggesting a link farm designed to redirect users to malicious content. The presence of these links and the overall structure align with phishing or malware distribution tactics.
Machine Learning
- Nyx PDF Classifier malicious score 0.9973
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://chcial.ru/uplcv?utm_term=come+all+you+weary+come+all+you+thirsty
- https://www.okcfarmersmarket.com/wp-content/plugins/super-forms/uploads/php/files/0f29a84a976dc4befd99ef8d7c7373d6/wuzudosamuv.pdf
- https://husvagnsexpo.se/wp-content/plugins/formcraft/file-upload/server/content/files/160b290e42afbd---sobipefuvitadafivok.pdf
- https://glowskincare.net/wp-content/plugins/super-forms/uploads/php/files/3eaaf76356b11790c4ab5de2e2f51805/86164629965.pdf
- http://bjoybrands.com/wp-content/plugins/formcraft/file-upload/server/content/files/160f88961dadeb---gukulikupunivupewisafo.pdf
- http://www.nbrownies.com.br/wp-content/plugins/formcraft/file-upload/server/content/files/16127cb3aaca7a---xujaperurilesumag.pdf
- https://arihantgranites.in/wp-content/plugins/super-forms/uploads/php/files/5p1ghnere3cr4rsh6fq22vnjn4/rovadanelejekabolasuf.pdf
- https://sarujiovalente.com/wp-content/plugins/super-forms/uploads/php/files/kk32sgogqspo72buh7k03a87oo/1292835987.pdf
- http://provia-events.de/pics/fotos/1/file/80114178781.pdf
- https://adm.allianceflooring.net/wp-content/plugins/super-forms/uploads/php/files/10f305ec3ba8c01e63b83aff910239a3/romiritexezudoze.pdf
- http://dmn.ca/wp-content/plugins/formcraft/file-upload/server/content/files/160f86d9f9dc75---14368192652.pdf
- https://3dreamvr.com/wp-content/plugins/super-forms/uploads/php/files/75560dbba87ccd4d31ae4853923f1680/48750578306.pdf
- https://catherinehourihan.art/wp-content/plugins/super-forms/uploads/php/files/59c95cc0460a6750436f6a03a2522f87/25419981421.pdf
- https://dispomydeal.com/wp-content/plugins/super-forms/uploads/php/files/2a25f7d88434f0c7844dc6e8f2d20e3d/54596844788.pdf
- http://maturitni-ples.eu/UserFiles/File/guzazafixigiseduloba.pdf
- http://talleresjpg.es/img/file/6573420346.pdf
- https://ontime-taxi.kg/wp-content/plugins/super-forms/uploads/php/files/6bdee1697458c9f1cff0b0740c3ad8a2/46332294186.pdf
- https://law.myvzl.com/wp-content/plugins/super-forms/uploads/php/files/d2lfvf87bkv16rcojok9ksghpc/torupoduvixuwarivufomu.pdf
- https://www.properties-thassos.com/wp-content/plugins/super-forms/uploads/php/files/mabr5u1htq72upi52j7gu5gr1d/87262420220.pdf
- http://geobrofab.com/clients/d/da/da7cd3953015cd63472398095fc1fcdd/File/pawoj.pdf
- https://thewaves.net/wp-content/plugins/super-forms/uploads/php/files/rtf689p4eicfkmfdc88fi1gvmf/24670013704.pdf
- http://euredit-editions.com/userfiles/file/jimaxudu.pdf
- http://hattrick-sports.com/wp-content/plugins/formcraft/file-upload/server/content/files/16082a26f2f60b---74929177792.pdf
- https://ksboutlet.com/file/files/jasuxelop.pdf
- http://kemenyseprosiklos.hu/upload/file/44829009213.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000c35f.bin0f094fd5191a4768ed7e857bf9cb94e786e5a9e468d973a5e0b1706f39acb53d |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xC35F | 18912 bytes |
font_01_sfnt_off0000f514.bin9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF514 | 16792 bytes |
font_02_sfnt_off00010d2b.binfab4a06ed8d20af481847ce92d231b0feb8720d435ebd73cb3b39722dd265f0c |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10D2B | 10720 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.