Malicious PDF — malware analysis report

Static analysis result for SHA-256 0582ddd7bfd7bf75…

MALICIOUS

PDF

67.7 KB Created: 2021-03-17 00:13:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 468bc78d408496f9d4db2b4279ebb975 SHA-1: 7ed555cdd6843f465deda299a7b88f86a2b9b470 SHA-256: 0582ddd7bfd7bf75929b2bc1e45bf3c762d6af9242ca7e1d92226b677385a35b
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF file flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier. It contains numerous embedded URLs, with one prominent URL pointing to 'baarspo.ru' which is associated with a link farm heuristic. The document body, though heavily obfuscated, contains text related to 'Aambala songs free masstamilan', suggesting a lure to attract users to click on the malicious link. The presence of multiple disposable hosting domains and link farms indicates a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=aambala+songs+free++masstamilan
    • http://mnogolidov.xyz/knee_aspiration_procedure_note_templatef6mva.pdf
    • https://cdn.sqhk.co/wudawagirus/ujdPxge/the_chosen_apple_tv.pdf
    • https://cdn.sqhk.co/jugomuzuteb/jiyTgfM/pifafakoletodav.pdf
    • http://medemukiduba.sportsontheweb.net/81905703437.pdf
    • http://microbestdigitalmeter.xyz/best_biodata_format_for_jobulsv4.pdf
    • http://topchambre.xyz/fegobosevipizujuj1k1q.pdf
    • http://fishland.store/economic_nationalism_definition_world_historyzhs6l.pdf
    • http://italywow.info/zoseputidonoviruvewazati5x5vu.pdf
    • https://cdn.sqhk.co/xezafube/jhjh22o/rigovel.pdf
    • http://lozipazom.sportsontheweb.net/defemezifekufemapatejexox.pdf
    • https://cdn.sqhk.co/rabataxuvax/vjaijjb/french_goalscorers_world_cup_2018.pdf
    • http://wellwork.site/devskiller_test_answersml9dw.pdf
    • http://odemebayisitrafik.com/negifefefekixoromovjoxid.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://59e5a08b-0d8d-455f-a3a7-35a3b781ab3e.filesusr.com/ugd/784815_583d77325d8b497f81de62572c8b8109.pdf?index=true
    • https://734e8db3-b9db-457c-abaa-08c06218e7ae.filesusr.com/ugd/f6bb82_849ba3ab1d574999ac787346d26220f6.pdf?index=true
    • http://fumibilulad.atwebpages.com/lulonusajisojub.pdf
    • https://c8070bf9-ed42-4c5d-8eb8-ca35ee70f136.filesusr.com/ugd/d38238_87e68ead4d7b4437be149bdd636014e7.pdf?index=true
    • https://0f4267a5-27df-427f-b7ff-de3c6d4a4cd0.filesusr.com/ugd/9e4921_c552d3e629894373acc23ae216b39074.pdf?index=true
    • http://pozidijapepore.atwebpages.com/brian_tracy_eat_that_frog_amazon.pdf
    • http://belibivizonojo.myartsonline.com/wepekidogezugidubabido.pdf
    • https://4adff18d-dc39-4349-be2c-eeb12737f1cb.filesusr.com/ugd/9117e0_baec2ada8cb94c329b5625e452f172b3.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cc54.bin
9b9ae15576ba0c1375addf4cfaf213a9748cec9b206fbbf0391f30615859de22		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCC54 5216 bytes
font_01_sfnt_off0000ddfe.bin
0d6fecac273870e87b1b5b4bd7092722ea4384515c25bc2f9efac06b4b3865ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDDFE 10424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.