Malicious PDF — malware analysis report

Static analysis result for SHA-256 1adee3951b09e92e…

MALICIOUS

PDF

79.4 KB Created: 2021-03-17 21:41:09 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 447830ac7410e71110eb18b0bbfffba1 SHA-1: db2f1118d80b13050194243e9a8a7a0c5e57a5e1 SHA-256: 1adee3951b09e92e9961dc0550d8838ce8608f57c3d509fa7eada61b755ab70e
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, including one to 'baarspo.ru', which is indicative of a link farm or phishing attempt. ClamAV and ML classifiers flagged this PDF as malicious, specifically as a phishing trojan. The presence of embedded URLs and the PDF_SEO_LINK_FARM heuristic suggest the primary goal is to redirect users to potentially malicious sites, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/wix?keyword=lg+french+door+refrigerator+dimensions
    • https://cdn.sqhk.co/jigavozef/ggiehf8/nebavugosatufofukub.pdf
    • https://cdn-cms.f-static.net/uploads/4451225/normal_602d78314f72e.pdf
    • https://cdn-cms.f-static.net/uploads/4530151/normal_601fe538f1ab7.pdf
    • https://cdn.sqhk.co/roweziwamu/iiM52hb/43165585478.pdf
    • http://tijudozi.scienceontheweb.net/corsair_commander_pro_setup.pdf
    • https://static.s123-cdn-static.com/uploads/4392441/normal_60012e880e64d.pdf
    • https://cdn-cms.f-static.net/uploads/4413228/normal_6032f2d9050a7.pdf
    • https://cdn.sqhk.co/zedozomi/hgigiha/36286324632.pdf
    • https://cdn-cms.f-static.net/uploads/4494432/normal_602c5306b868b.pdf
    • http://lugabev.mygamesonline.org/asus_ac1900_aimesh_setup.pdf
    • https://cdn.sqhk.co/delojiwuguj/86p6yPL/hotels_near_chatsworth_house_with_swimming_pool.pdf
    • https://cdn.sqhk.co/mosepoxik/dhgugfR/old_glory_fishing_facebook.pdf
    • http://suvuxivenorum.mypressonline.com/roraxivepudanopizuk.pdf
    • https://cdn.sqhk.co/gegatuzikat/jjxiajb/learn_carpentry_los_angeles.pdf
    • https://cdn.sqhk.co/waxipefimafa/jgifFjc/grande_iced_matcha_latte_with_almond_milk_calories.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/63c80377-19f9-4a0c-a58f-b32a5b540e56/what_are_the_interview_questions_for_manual_testing_for_2_years_experience.pdf
    • https://uploads.strikinglycdn.com/files/c5db7edb-0f8d-4d0c-9e02-a7554ac1e40f/pugixefe.pdf
    • https://uploads.strikinglycdn.com/files/0420ed1a-8e28-448f-863d-f44e4bd0811b/disney_world_fireworks_times_september_2019.pdf
    • https://uploads.strikinglycdn.com/files/b3304f49-59aa-4581-ac82-30a4788f7232/how_to_prepare_for_a_4_point_home_inspection.pdf
    • https://9eaa565e-fb97-40b4-b096-d6760803f699.filesusr.com/ugd/55e2c6_0b434c671903488fb2bf4a61b0229e12.pdf?index=true
    • https://357b8bef-7330-4cfe-b31d-389db25c4d5a.filesusr.com/ugd/4c76bf_441adb1381e1485fa8452e90db8f9627.pdf?index=true
    • https://09ec9d85-9312-4337-94d0-b84080e05f2e.filesusr.com/ugd/ac0094_ad7242ca2155478299f7a9a058ac2dca.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb19.bin
bc1fe8584b3d9bbcdc9e502a5b841b48e5e46386589255054b6b40029c49833b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEB19 5132 bytes
font_01_sfnt_off0000fc53.bin
4fda2e7c66c3b2f3583d0efa023fe96183869811d3cd2b959a88c6ff28c21069		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC53 11112 bytes
font_02_sfnt_off0001221f.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1221F 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.