MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains a link farm pointing to multiple compromised WordPress sites, indicating a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent. Although no scripts were explicitly extracted, the presence of embedded URLs and the 'PDF_COMPROMISED_CMS_UPLOAD_LINK_FARM' heuristic indicate the document is designed to redirect users to malicious content hosted on these compromised sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9951
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://asckhn.com/acskhn/userfiles/file/lizazinisofekulikobobibim.pdf In PDF document text
- https://www.blackandwhite-salon.com/wp-content/plugins/super-forms/uploads/php/files/c68d070304b74213f6c3475f41489366/99679464857.pdfIn PDF document text
- http://www.phonefixcomo.com/wp-content/plugins/formcraft/file-upload/server/content/files/16077cbe29ae5c---jibiditufotivomus.pdfIn PDF document text
- http://www.northeastmarquees.com/wp-content/plugins/super-forms/uploads/php/files/1e73883ae658e406f0176244e8cb275b/zusomopulubalopebadim.pdfIn PDF document text
- http://tradeweb.es/userfiles/file/takar.pdfIn PDF document text
- https://yssnewlessons.org/UserFilesTwo/file/19850439007.pdfIn PDF document text
- https://macleanpinesdrivingschool.com.au/wp-content/plugins/super-forms/uploads/php/files/25d8f66e49f8709e23c42058419b79e8/feresetipige.pdfIn PDF document text
- https://www.digitalsofts.com/wp-content/plugins/formcraft/file-upload/server/content/files/1609da40444433---31009759843.pdfIn PDF document text
- https://alnahamgroup.com/userfiles/file/83166456666.pdfIn PDF document text
- https://www.karavanlakesfet.com/wp-content/plugins/super-forms/uploads/php/files/e63e196e314590643d3b1d70cc6dbde0/2631952013.pdfIn PDF document text
- https://dixietemporarystorage.com/wp-content/plugins/super-forms/uploads/php/files/9aa274a3c39e0950a913208d2d28e5c7/70034245974.pdfIn PDF document text
- http://saludocupacionalpso.com/home/wp-content/plugins/formcraft/file-upload/server/content/files/160a99b0648189---punedotozabiwepazopexep.pdfIn PDF document text
- http://www.moteco.ro/wp-content/plugins/formcraft/file-upload/server/content/files/160ad8c4b0e935---52231971436.pdfIn PDF document text
- https://nam.it/wp-content/plugins/formcraft/file-upload/server/content/files/1608d3af7f2759---davoperuguzolupepiwoz.pdfIn PDF document text
- http://www.rkcomdesignservices.com/wp-content/plugins/formcraft/file-upload/server/content/files/16070bfe83bbfa---4062804472.pdfIn PDF document text
- https://pluckywize.com/wp-content/plugins/formcraft/file-upload/server/content/files/1608e8c0410825---tatekavazodito.pdfIn PDF document text
- http://ahlhy.com/uploads/file/182024194142.pdfIn PDF document text
- https://rittenhousesmiles.com/wp-content/plugins/super-forms/uploads/php/files/ede4dc76c903ee64f6a82091fd9077c3/18958859353.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/S30rS-6n6vg/uplcv?utm_term=bir+contact+number+cebu+northPDF link annotation
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0002d84d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2D84D | 5020 bytes |
SHA-256: 01bea2c6eb43a70cdbe46e9a9a8ab7a41e3e9398ae2d1a042411064094cda201 |
|||
font_01_sfnt_off0002e936.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2E936 | 11972 bytes |
SHA-256: 139fb363131b24535458052c0c193b97400d4e348e2d9bdfff585fd2e93d7b37 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.