Malicious PDF — malware analysis report

Static analysis result for SHA-256 a47e754284dce5d0…

MALICIOUS

PDF

77.5 KB Created: 2021-06-01 15:48:11 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5c16e2c169cdf61f40820dacf6982c9d SHA-1: 9390b4878f1b456f046599f1f6976f58161d26d9 SHA-256: a47e754284dce5d0204f744a2025fb32c6866ba11675e11017e32d2139c9822b
176 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan threat. It contains a large number of external links, many pointing to PDF files hosted on Weebly, suggesting a link farm or redirection mechanism. The document body, though heavily obfuscated, contains text related to setting up a cable box, likely a lure to encourage users to click on the embedded links. The presence of external URIs and a link farm heuristic strongly suggests the document's primary purpose is to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://irlanc.ru/pbw?utm_term=how+to+hook+up+cable+box+from+spectrum
    • https://wariraxaluxar.weebly.com/uploads/1/3/3/9/133986847/jalixowodaxononajota.pdf
    • https://medekegiloninev.weebly.com/uploads/1/3/4/7/134716174/tejagim-loridag.pdf
    • https://xefigokilevugez.weebly.com/uploads/1/3/5/2/135299251/1217bee4ba15.pdf
    • https://tenekitu.weebly.com/uploads/1/3/4/0/134018212/2063553.pdf
    • https://libosimi.weebly.com/uploads/1/3/4/0/134000241/16f46b.pdf
    • https://rujazako.weebly.com/uploads/1/3/4/4/134471695/vigujutaruzaj-roxexaxo-ferax.pdf
    • https://tinulesuse.weebly.com/uploads/1/3/4/6/134689832/190142.pdf
    • https://ketafimevudo.weebly.com/uploads/1/3/1/6/131637081/kizuk_wopavegupowad_wosugam_bixosaxat.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/e20d2fac-7d6b-43db-888c-f9a6925c254d/1989459750.pdf
    • https://uploads.strikinglycdn.com/files/8fa48289-410c-45fc-9d6b-f334f1b1e912/rh_sin_books_online.pdf
    • http://tisowowuduwe.pbworks.com/f/28106939969.pdf
    • http://degenazi.pbworks.com/f/65728570256.pdf
    • http://giresizuloki.pbworks.com/f/73376294561.pdf
    • http://wozixokumo.pbworks.com/w/file/fetch/144434466/wiwuwo.pdf
    • https://uploads.strikinglycdn.com/files/848a68f2-2900-45ca-8979-41278b7ed15d/average_salary_of_amazon_operations_manager.pdf
    • https://uploads.strikinglycdn.com/files/6bd72c5a-58dc-4b00-a497-0de1915eed1b/46012661059.pdf
    • https://uploads.strikinglycdn.com/files/e027e2e1-7dc3-45fd-8183-21d47d579d48/jowesowixijakozim.pdf
    • http://xedidovetaw.pbworks.com/w/file/fetch/144417621/35744103273.pdf
    • http://kinuwibe.pbworks.com/f/how_do_you_connect_2_jbl_speakers_together.pdf
    • http://kiletejude.pbworks.com/w/file/fetch/144411681/how_to_mix_salt_reef_tank.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000edd8.bin
658d4c99cacdcdb345dc2f596a99756b01444e4287e651801ed480973497e91d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEDD8 5580 bytes
font_01_sfnt_off000100ba.bin
3f862d6a749f6af221f2511f4d5714ced5068667f222cec3b64839c290921c8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x100BA 11324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.