Malicious PDF — malware analysis report

Static analysis result for SHA-256 01c947b3d2fc948f…

MALICIOUS

PDF

80.2 KB Created: 2021-03-06 15:44:28 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 3724bfb8a364f1c747af7cd82dcd36ab SHA-1: 5ce03ee6cd0ca70b01b814ad5e861e0bf7d0de93 SHA-256: 01c947b3d2fc948fe27f03347517b18d16ab9bed16246034f0a6bee1eb306328
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. It contains a large number of external links, many pointing to PDFs, suggesting a link farm or redirection mechanism. One prominent URL, https://baarspo.ru/strik, is likely used for phishing or to host a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=what+is+the+purpose+of+supply+chain+management+systems PDF link annotation
    • https://cdn.sqhk.co/vinasujitupe/iibgfje/59451504850.pdfIn PDF document text
    • http://tuimag.ru/fusoxidareki661t6.pdfIn PDF document text
    • http://cesaregaspari.com/denilirizulubofujekukiy3i14.pdfIn PDF document text
    • http://meetcabinets.xyz/koromapufiri4n4m.pdfIn PDF document text
    • http://dehydratedoriginalgoodness.com/adobe_acrobat_serial_number_locationblwzh.pdfIn PDF document text
    • https://cdn.sqhk.co/rekosiseweno/ghifihA/scdmv_permit_test.pdfIn PDF document text
    • http://azules.ru/angry_birds_rio_hack_apkkowk3.pdfIn PDF document text
    • https://cdn.sqhk.co/noluxokeruma/bd3Gggw/juxogenam.pdfIn PDF document text
    • http://business-open.online/93470717946om7ow.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fajonubinomeder/pumok.pdfIn PDF document text
    • https://s3.amazonaws.com/baxegezivumi/69927668987.pdfIn PDF document text
    • https://s3.amazonaws.com/divelatoxa/birod.pdfIn PDF document text
    • https://f459ab6e-ac57-43ce-b83a-1524846427e4.filesusr.com/ugd/938c70_4bd7e2d8a0264eb38356e177dcd4db0b.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/pexodugosa/74946261549.pdfIn PDF document text
    • https://s3.amazonaws.com/jivamubug/boyfriend_justin_bieber_song_ringtone.pdfIn PDF document text
    • https://s3.amazonaws.com/sukobogixe/naruto_shippuden_games_for_android_tablet.pdfIn PDF document text
    • https://435a888a-8f80-410d-aa77-77edd6e4491d.filesusr.com/ugd/51fec0_ba3496e270954015844bce6f67fda854.pdf?index=trueIn PDF document text
    • https://04934832-22f3-474e-96de-b9d593e92251.filesusr.com/ugd/f390e7_2185b3de7e7246669f0856b3f65a21a6.pdf?index=trueIn PDF document text
    • https://994180ce-385f-4272-9833-4a204a825e0f.filesusr.com/ugd/ec0c41_440fddea707d49e0aca7e2efc5c75376.pdf?index=trueIn PDF document text
    • https://ff06b2c9-6223-4357-b4d5-1bf3807c749f.filesusr.com/ugd/717131_db8b883340624c26afabe46824de6acf.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/dufekifaral/88807947903.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc42.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFC42 5544 bytes
SHA-256: 23fc25db93c021f0065fe459763d252aee8ee9b2e6a89b7937acebf71a7a384a
font_01_sfnt_off00010f0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10F0D 10424 bytes
SHA-256: 43a8e14dab7f44353b303fd614963262e93118e474c114c5dabf18c7b77c5aa3

Open this report in the interactive analyzer, or submit your own file for analysis.