Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f60daa42fea42f9…

MALICIOUS

PDF

52.9 KB Created: 2021-03-23 21:47:53 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fcfbc3ec1ddd2721cf8851fe209f3309 SHA-1: 43a3f66abec7febee1a1a04e8d949522c6aa7fab SHA-256: 0f60daa42fea42f9d870a261335292a65b5938626f61c3f60d9513a53fd24ae2
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by multiple heuristics, including ClamAV and an ML classifier, and is structured as an image-only lure. It contains a mass of external links, with the primary suspicious URL being https://baarspo.ru/award?keyword=aritmatika+biner+pdf. The document's design suggests it is intended to trick users into clicking these links, likely leading to phishing pages or further malware downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8840

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 52 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=aritmatika+biner+pdf
    • https://kizofirelurok.weebly.com/uploads/1/3/1/6/131606598/musikoziludexa_sukawataxej_selubirimo_mivaxoniwiloz.pdf
    • http://trysalon.xyz/how_to_put_a_jawbone_jambox_in_pairing_modehtb3l.pdf
    • https://furadigiwib.weebly.com/uploads/1/3/1/4/131407367/89818.pdf
    • https://meripowubizaj.weebly.com/uploads/1/3/5/9/135959363/selutoru.pdf
    • https://xizexinapak.weebly.com/uploads/1/3/4/3/134359948/087af89.pdf
    • https://mekapejodefab.weebly.com/uploads/1/3/4/7/134740006/katuzozuvutip-tobedepaj.pdf
    • http://pinerapidsrr.com/fabapenesozelexomojitkzsd.pdf
    • https://96a9e3af-f0c3-4048-9e6c-0ad8da3c6018.filesusr.com/ugd/15d534_b4bac92b8fc54b989b893f55538317a0.pdf?index=true
    • https://uploads.strikinglycdn.com/files/f6255cb0-168a-40a0-b79f-45d702b66876/mcdougal_littell_algebra_2_textbook_answers.pdf
    • https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_72709a40f76648e4802c6666253ecf65.pdf?index=true
    • https://s3.amazonaws.com/dewutexorob/55356355554.pdf
    • https://s3.amazonaws.com/gajakelegeza/consonant_digraphs_th_worksheets.pdf
    • https://s3.amazonaws.com/xonaxevetaf/26456689974.pdf
    • https://s3.amazonaws.com/jarirotexab/gisexolibolojutibug.pdf
    • https://eee7329a-c4d5-4508-a8fd-a8ba515f7d9f.filesusr.com/ugd/5ed802_20c1f5d9d64046d7bce857cffaa5db5a.pdf?index=true
    • https://a49a6154-edc8-4132-95a2-c7bb8d673fe9.filesusr.com/ugd/551169_221a47eddeaf49e1a487eae917cee768.pdf?index=true
    • https://uploads.strikinglycdn.com/files/842d6dbc-dfce-4c00-8be7-af4e7ac1a138/demoneduleweba.pdf
    • https://012a8781-80b6-4d33-8f63-56d56ef93f15.filesusr.com/ugd/6d3794_5593f247840b49d7bd1308c459b423c8.pdf?index=true
    • https://4900ecec-7ac1-411c-be2c-b077674085c8.filesusr.com/ugd/493135_6c040325b9ee40fb9e150536fcaca508.pdf?index=true
    • https://59cf682b-6680-4a08-8b8d-0472bab64ef7.filesusr.com/ugd/d7d6cd_c46ae759ec994642b36abbe0869365e7.pdf?index=true
    • https://8f1ef4f7-3f23-41ef-a3d6-4e5873a175a2.filesusr.com/ugd/d318ce_96abffece914426b8310212f593addac.pdf?index=true
    • https://441768bb-9839-4df4-8f78-dd1233b527f6.filesusr.com/ugd/7e6080_63e060668e374bc798daba48c290f6ea.pdf?index=true
    • https://87098103-4d08-48bb-90a6-807b0ef734b2.filesusr.com/ugd/1f49de_577268ef07a448d69b86cfd2dfe499b7.pdf?index=true