Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a05d30f4be12da6…

MALICIOUS

PDF

79.9 KB Created: 2021-03-18 18:06:50 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ebdea36a29f9c153d02a24c2f4d2fc91 SHA-1: 19290ce100b6140136f393ec31e50aaaf6e147e0 SHA-256: 2a05d30f4be12da63eae848f4e0c5fbd4342dc416219d5896d90365954ee05f4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'baarspo.ru', which is highly suspicious and likely part of a phishing or malware distribution scheme. The document body is heavily obfuscated, preventing a clear understanding of its specific lure, but the presence of external URLs strongly suggests malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=ordinal+number+in+english+pdf
    • http://shmelev.pro/docker-_compose_commands_cheat_sheetffkhh.pdf
    • http://euroshopmn.space/pigofenaqhsi.pdf
    • http://options.expert/20984583729fojtl.pdf
    • http://vurenosul.22web.org/game_dev_story_mod_unlimited_money.pdf
    • http://milanbeachs.space/windows_10_converterciw6p.pdf
    • http://zoom-omsk.ru/179440730072l697.pdf
    • http://techanomic.com/jofokibi7nfnf.pdf
    • http://ipoteka.net/upgrade_android_oreo_8._1e31o8.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://2ed821ec-8078-4e74-b11b-c5cec6a88262.filesusr.com/ugd/65e777_e8ebce3b749a4398a22daeab9308114f.pdf?index=true
    • http://ruzojonawa.epizy.com/artificer_chunked_guide.pdf
    • https://299bc67c-4c9a-44ea-852c-18f2d39dca40.filesusr.com/ugd/954c8b_6e340887e483476bb54d790bf620eab1.pdf?index=true
    • https://2a26c5f8-c4f8-4af8-830b-7e2c9961bd8e.filesusr.com/ugd/2e4362_a8a6a8fbb4b14fffa01c8df62d905bec.pdf?index=true
    • https://f1e11ea9-a931-46ad-af30-391325c877dd.filesusr.com/ugd/423518_2a8ba7fb50984359b60ba36c14bdb3a5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/51c26bee-6ffd-47b4-a792-74bf6b456506/iphone_5_battery_price_original.pdf
    • https://3bdad275-8828-414d-9063-9532e035d791.filesusr.com/ugd/c67d0c_08d96a28a2da4a408b797d971dace685.pdf?index=true
    • https://76df98a8-3e94-4eee-a6f5-23e1de06049b.filesusr.com/ugd/54c74c_4d2957eb88dc403699630b4daa402aa2.pdf?index=true
    • https://1682489e-d94b-4f22-b6a6-c8ecb623ca2e.filesusr.com/ugd/5f226e_a25ea7ad3718438fa19e774dfda56bf3.pdf?index=true
    • http://filipebed.rf.gd/plantronics_headset_cs530_instructions.pdf
    • https://uploads.strikinglycdn.com/files/193c1e13-7fe7-4160-bc30-86fda0695233/how_to_use_innova_obd2_scanner.pdf
    • https://cf336f9a-6a79-4542-9269-5b62d6eb69dd.filesusr.com/ugd/1daf83_c5b66ead5713414b94f6b955d1937c50.pdf?index=true
    • https://uploads.strikinglycdn.com/files/75fb2fbb-f72f-4aec-90da-5d70a7dae869/74894696556.pdf
    • http://lususexore.epizy.com/agent_orange_vietnam_war.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ea89.bin
36fc54b38c85820c0060e2fc7a71a9d71f9e7daf964b06e35f63dd059a88aad3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEA89 3992 bytes
font_01_sfnt_off0000f8b7.bin
cabcc1ac3822a20006ac968fff4b034f2ada66e8d3e8a37fe8a168d06e590147		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF8B7 5620 bytes
font_02_sfnt_off00010b9b.bin
6b149bb550a979bf35ea3606a5fd60b0518ac34ed05f720d7380b78b6ab4e897		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10B9B 11276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.