Malicious PDF — malware analysis report

Static analysis result for SHA-256 099482b0f5b866d6…

MALICIOUS

PDF

90.3 KB Created: 2021-03-10 17:53:27 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-26
MD5: 13751acc577d73fdbad487fe808257a1 SHA-1: 77344d577fd6399c455aa91cec6f8033dcb46fec SHA-256: 099482b0f5b866d6d2f69a5144220073c8325db4dc01e80d7d208723eaf28dd7
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating a link farm and an embedded URI pointing to 'baarspo.ru'. The document body, though partially corrupted, suggests a lure related to an economics course. The presence of numerous external links, including one to a potentially malicious domain, strongly suggests a phishing or redirection attack. While no scripts were explicitly extracted, the PDF structure and heuristic firings indicate malicious intent, likely to lead the user to a compromised site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9967

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=curso+de+econom%25C3%25ADa+de+la+empresa.+introducci%25C3%25B3n+2020+pdf PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4393785/normal_600f9976d4657.pdfIn PDF document text
    • http://luminar4-download.xyz/brother_hl_2140_drumhz3yw.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4476750/normal_60344d994a4ec.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4454168/normal_60147f87c46e2.pdfIn PDF document text
    • https://cdn.sqhk.co/pobijejok/bUhgja8/chromosomal_disorder_definition_biology.pdfIn PDF document text
    • http://runmasten.online/bexabatagibiwikumkt57b.pdfIn PDF document text
    • http://sodahq.pro/6339031402dym5d.pdfIn PDF document text
    • https://kojaresojew.weebly.com/uploads/1/3/4/3/134312518/zalobibonuvif_wawokulunirida_lizewabe_nomudupuz.pdfIn PDF document text
    • https://satizivuzaked.weebly.com/uploads/1/3/4/3/134383512/welopivak.pdfIn PDF document text
    • https://gefeteki.weebly.com/uploads/1/3/4/3/134310298/nalodifejuve.pdfIn PDF document text
    • https://lamamamim.weebly.com/uploads/1/3/1/6/131606140/pixilelededo-vavapof-xolafutuvar-xunepomalo.pdfIn PDF document text
    • https://vokudaminovisuz.weebly.com/uploads/1/3/4/4/134495340/5a27d67c576128.pdfIn PDF document text
    • https://cdn.sqhk.co/fiseguvugele/jhijfNY/weather_today_at_my_location_hourly_rain_today.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369773/normal_60481b636fd67.pdfIn PDF document text
    • https://cdn.sqhk.co/xejadukoxeta/fDspUqh/luzare.pdfIn PDF document text
    • https://cdn.sqhk.co/butemobe/efDhaia/kevavolowelelenuler.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4425759/normal_5fff575d9f5c5.pdfIn PDF document text
    • https://cdn.sqhk.co/wabajevebe/HgiBjhD/metal_boyas_sprey.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/sutawowirosuvuv/dajirimeg.pdfIn PDF document text
    • https://s3.amazonaws.com/bisiku/jafodanutu.pdfIn PDF document text
    • https://s3.amazonaws.com/dibedamoka/spotify_premium_mod_apk_indonesia.pdfIn PDF document text
    • https://s3.amazonaws.com/toliwudalamem/gapibasuwowigazi.pdfIn PDF document text
    • https://s3.amazonaws.com/wozoxub/nenupeka.pdfIn PDF document text
    • https://s3.amazonaws.com/nevovumowa/tinokobida.pdfIn PDF document text
    • https://s3.amazonaws.com/mupukesunobaga/49837247394.pdfIn PDF document text
    • https://s3.amazonaws.com/sugowubuf/81779905100.pdfIn PDF document text
    • https://s3.amazonaws.com/mubefula/sheet_music_template_illustrator.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011d3d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D3D 5700 bytes
SHA-256: 2a16f9337b8e7df81defa6b2489a4ef12f71588c586355775aa2a15424b6d74a
font_01_sfnt_off00013047.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13047 12576 bytes
SHA-256: b77bcc6c354673c1d6828594a0d3e8ed5b35a20ef2bdc6d9eb62da89511960b1

Open this report in the interactive analyzer, or submit your own file for analysis.