Malicious PDF — malware analysis report

Static analysis result for SHA-256 7409164204cbe344…

MALICIOUS

PDF

86.6 KB Created: 2021-03-24 00:09:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dcbbfcbb226851fbe3e699e373631245 SHA-1: db60ffb5f7116b799d264d8ecfd34d7cc387277d SHA-256: 7409164204cbe344780a4da06747b63c9d10b90d32710933a2d50057271862b0
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many pointing to Weebly-hosted PDFs, suggesting a link farm or SEO abuse tactic. The primary URL, 'https://xezojetit.ru/wix?keyword=weber+genesis+s330+manual', is presented as a manual, likely a lure. ClamAV detection and ML classification strongly indicate malicious intent, specifically phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xezojetit.ru/wix?keyword=weber+genesis+s330+manual
    • https://dazenesulamese.weebly.com/uploads/1/3/1/1/131164173/xepogonuxu.pdf
    • https://jamafijuzu.weebly.com/uploads/1/3/1/4/131437216/2390736.pdf
    • https://jobekivisa.weebly.com/uploads/1/3/4/5/134584889/vupekirupi_nilekotebosiziv_vosizo_dogegajozi.pdf
    • http://sitebomobegux.sportsontheweb.net/66322665754.pdf
    • https://riwaxetonebena.weebly.com/uploads/1/3/4/3/134363930/7232514.pdf
    • http://nujijaj.getenjoyment.net/31589938625.pdf
    • https://gilepinewuje.weebly.com/uploads/1/3/4/0/134096317/5677341.pdf
    • https://simefaburiso.weebly.com/uploads/1/3/0/8/130814859/wesubeme_temagoreligixap_xijuf_duvadunekud.pdf
    • https://xegabazoku.weebly.com/uploads/1/3/4/3/134318522/lebokiwawipovufexolu.pdf
    • http://misujupino.getenjoyment.net/annotate_application.pdf
    • https://wazufepema.weebly.com/uploads/1/3/5/3/135383665/lulavofebusuv-renupozuri-natitefoki-bexisipolawif.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/liwara/pudopixixul.pdf
    • https://uploads.strikinglycdn.com/files/a27be446-2095-42c6-b05c-79f3d35e15d4/60222544180.pdf
    • https://uploads.strikinglycdn.com/files/0f6bf032-f33d-4afe-af7c-b85b9173c5dd/95206822961.pdf
    • https://uploads.strikinglycdn.com/files/3f05217e-4be9-4eb5-8682-145e3b86b06f/25421032778.pdf
    • https://f98f40d2-b649-4e6b-99af-b89bbf2331ff.filesusr.com/ugd/724bd4_6e06b0b8ffac41808dd1d5239ae8ed67.pdf?index=true
    • https://s3.amazonaws.com/puretulenuza/5198361653.pdf
    • https://s3.amazonaws.com/vipinib/where_is_the_battery_in_my_2011_chevy_traverse.pdf
    • https://uploads.strikinglycdn.com/files/8026bbfb-faef-4cb8-9e67-620b23d46c99/22179003391.pdf
    • http://mojozore.myartsonline.com/application_letter_for_engineer_position.pdf
    • http://wovibojo.onlinewebshop.net/the_entertainer_ukulele_tab.pdf
    • https://uploads.strikinglycdn.com/files/d20c4b17-5cdd-4ac3-8646-20013f630077/why_does_my_craftsman_weed_eater_dies_when_i_give_it_gas.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010726.bin
8f88885354a617718bb10d8d3ed272fd1f5e8174c6d9dc5f1053e9b7e9c1f04a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10726 5464 bytes
font_01_sfnt_off000119b0.bin
073a45c8e695ffc8da01547ac4b4599fb259c03cd5b4aa0e1ef9c3833c0cb423		 pdf-font-stream PDF embedded font (sfnt) at offset 0x119B0 2048 bytes
font_02_sfnt_off0001228f.bin
d53dd026f453aa5d569bccd2bb632785be9f1cccf3c7a882d8fb57ea62609710		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1228F 13436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.