Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b3a7fda2717bb84…

MALICIOUS

PDF

89.7 KB Created: 2021-04-06 17:15:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 0278a9df5f3615038596d3b485e3b039 SHA-1: 685bd05fc28b7a3c5272dc696e418a15759befcc SHA-256: 7b3a7fda2717bb844f1918ad4af674f2a4e0b527f2eb04d77f319175c5bc5515
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is identified as malicious by ClamAV and an ML classifier, with critical heuristics indicating it contains a large farm of external PDF links. The document body, though partially corrupted, suggests a lure related to a heater manual. The presence of numerous external URLs, many pointing to Weebly and other free hosting services with numeric slugs, strongly indicates a phishing or SEO manipulation scheme designed to redirect users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9951

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/wix?keyword=lasko+motion+heat+plus+whole+room+heater+manual
    • https://vebafuxitupum.weebly.com/uploads/1/3/4/8/134890404/cc8e732323e3e.pdf
    • https://cdn-cms.f-static.net/uploads/4387419/normal_60110d6081d05.pdf
    • http://moxipafuxoxo.mygamesonline.org/cfrp_material_properties.pdf
    • https://sajinekud.weebly.com/uploads/1/3/5/3/135391411/tudusaji.pdf
    • https://fuvedomuwipiw.weebly.com/uploads/1/3/1/6/131636935/bekel.pdf
    • http://norasuzajo.mywebcommunity.org/ansi_asme_standard_pipe_size.pdf
    • https://jalidinetuvumun.weebly.com/uploads/1/3/5/3/135333814/gesawezuko_pivurixuwe_juwujega.pdf
    • https://cdn-cms.f-static.net/uploads/4495696/normal_60445a927c476.pdf
    • https://static.s123-cdn-static.com/uploads/4479451/normal_5ff79d31914da.pdf
    • http://jezonikiroka.mygamesonline.org/fiweb.pdf
    • https://cdn-cms.f-static.net/uploads/4461746/normal_6052f898812fc.pdf
    • https://fanakigefepawaf.weebly.com/uploads/1/3/0/8/130873796/7aad50300d0f.pdf
    • https://cdn-cms.f-static.net/uploads/4368763/normal_603883820f2c8.pdf
    • https://tumofevex.weebly.com/uploads/1/3/2/7/132710745/9563986.pdf
    • https://muzikalojex.weebly.com/uploads/1/3/4/0/134012647/642752.pdf
    • https://mefufexuwi.weebly.com/uploads/1/3/4/0/134019004/c9bcbee34.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/56c0c589-df6b-4887-a0f4-14cc889a1530/8041100168.pdf
    • https://uploads.strikinglycdn.com/files/297f52d3-5e27-49f1-b1d3-527ab4167408/17886096320.pdf
    • https://uploads.strikinglycdn.com/files/9ebfa914-0388-411f-a0dc-2847c4360503/jandy_pool_heater_jxi400n_manual.pdf
    • https://33edd578-4186-4695-89f3-f56a5a23fc53.filesusr.com/ugd/f17c08_4826200e57c545ce892a18b3da752545.pdf?index=true
    • https://a86a6b26-b473-4b55-b9aa-7628a2bff077.filesusr.com/ugd/4f270c_df320206cf61461dbfbbf0f7f319f1d7.pdf?index=true
    • https://uploads.strikinglycdn.com/files/fad2c875-3eb9-4a60-964f-320cd8ecc913/what_to_the_slave_is_the_fourth_of_july_quotes.pdf
    • https://uploads.strikinglycdn.com/files/da6f53be-62f9-40d3-a063-45a44cff1c43/day_of_the_dragon_new_holland.pdf
    • https://e22e8d81-f41f-4d51-abb1-39b19d2d32bb.filesusr.com/ugd/96bf9d_4290f043c7dd45c19d8f676dd866ace4.pdf?index=true
    • https://0c6b2c5e-c852-454c-8c01-bea24f6181fd.filesusr.com/ugd/b97644_ead542698e3a475a8aec2d28f3c09807.pdf?index=true
    • https://17673d3b-e5d0-4e0e-8211-f079fadf35f5.filesusr.com/ugd/13ae68_a3d72197fe964076b2cc682ee8a50a4c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010965.bin
9dce58654f856edd40f5ae31805e224e0a4f230234ebce2a626e0e7cdbc3fb3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10965 5156 bytes
font_01_sfnt_off00011ada.bin
a0d4006c7d0d1a338925eb1342f180cb4ac47db3d3c898722380d593c2ac7743		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11ADA 11736 bytes
font_02_sfnt_off00014262.bin
15f5ec4560497f6cd6d4998e68eb63b69c9eceb3a281ce3e3ad60286432bbb71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14262 16304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.