MALICIOUS
156
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
This PDF file was identified as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It functions as a link farm, directing users to multiple compromised websites, likely to host further malicious content or phishing pages. The presence of numerous links to potentially compromised CMS uploads suggests a tactic to distribute malware or redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9949
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://whscardinals1963.com/clients/9/9e/9e5fab02d16e7113a74bdd4e7828f974/File/daxejol.pdf In PDF document text
- https://www.kadeavenue.com/wp-content/plugins/super-forms/uploads/php/files/d0e2b27b970b93caea9600b33279305a/65292642462.pdfIn PDF document text
- http://tasteofruraleurope.eu/upload/File/goviketudalugijewivafifa.pdfIn PDF document text
- https://www.businesswatchguardingservices.co.uk/wp-content/plugins/super-forms/uploads/php/files/6dv63pidkmsjb5mvt5ucin1non/50979051363.pdfIn PDF document text
- https://polskieplytki.com/wp-content/plugins/super-forms/uploads/php/files/917f7d4801902a43650396ee7fab6bab/1677486210.pdfIn PDF document text
- http://xn--80ackbssfuieecff0e8c.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/vmesn9qouse1o5gf08pebj8jt5/66731651935.pdfIn PDF document text
- http://botosani.ro/img/uploads/file/tuwupuxufineweje.pdfIn PDF document text
- http://skuplaptop.pl/wp-content/plugins/formcraft/file-upload/server/content/files/160bc63e623c05---33245871067.pdfIn PDF document text
- https://aronabritcan.com/userfiles/file/faziluxofuro.pdfIn PDF document text
- https://ludifrance.fr/userfiles/file/81995473129.pdfIn PDF document text
- http://ecohort.com/userfiles/files/7333557512.pdfIn PDF document text
- http://ramenzoni.eu/userfiles/files/23461373291.pdfIn PDF document text
- https://xn----7sbabak5acz7byau.xn--p1ai/wp-content/plugins/super-forms/uploads/php/files/27bcb1bab11134360a72d6b6e9a871e6/89290849688.pdfIn PDF document text
- https://www.andrecampbell.ca/wp-content/plugins/super-forms/uploads/php/files/ab08754089899535f792897b7cf07c2f/92333449048.pdfIn PDF document text
- https://daynexweb.com/upload/ckfinder/files/96920632551.pdfIn PDF document text
- http://middlegeorgiacoinclub.com/wp-content/plugins/formcraft/file-upload/server/content/files/16095feacd622e---46637013795.pdfIn PDF document text
- http://cohn-vossen.com/wp-content/plugins/formcraft/file-upload/server/content/files/160da6b0e7f26e---gugusabul.pdfIn PDF document text
- http://amoy-art.com/Upload/file/5261191134.pdfIn PDF document text
- https://giustofiori.it/file/wenejokupu.pdfIn PDF document text
- https://www.zulilighting.com/wp-content/plugins/super-forms/uploads/php/files/2e459eecddf9e2f4363ea1dc6a9f7ad6/51624551075.pdfIn PDF document text
- http://gialtour.it/themes/userfiles//files/8518332888.pdfIn PDF document text
- http://www.studiolegalefusimorelli.com/wp-content/plugins/formcraft/file-upload/server/content/files/1607bef1912a8a---19943603104.pdfIn PDF document text
- https://www.jahnigterbraak.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16095e6c3ebd32---pujarivekutil.pdfIn PDF document text
- http://snsi.jp/image/news_file/76054688867.pdfIn PDF document text
- http://www.aqsclimited.com/EditorImages/file/munotuvazexifenewetab.pdfIn PDF document text
- https://feedproxy.google.com/~r/1eyvgo/aqOO/~3/Om9ozkHLxGw/uplcv?utm_term=jeff+madura+introduction+to+businessPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000d3ba.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xD3BA | 16792 bytes |
SHA-256: 9d2294e344127da9ddc2b77d68b1576b6b78373885bc9da2859f180a98f2c1e1 |
|||
font_01_sfnt_off0000ebcc.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEBCC | 16664 bytes |
SHA-256: da83aa804cfcbf51ebcab324872a71822d86657355c5d18f83f4fd53a3deb093 |
|||
font_02_sfnt_off0001171d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1171D | 10820 bytes |
SHA-256: 8affda3d384f261aa2154afb9b5687d6a47516929ee44d4ef1f04a91b50ea3b9 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.