Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a0b0ce4eda10195…

MALICIOUS

PDF

72.0 KB Created: 2021-01-31 01:43:00 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-07
MD5: dc2fa0137f527fb9cd76ce489c143e9a SHA-1: d76b837f6f4b797af4ad9c209762b60e9c141758 SHA-256: 2a0b0ce4eda10195236f13d0999aa0be396e6f5dec2ea9d648e27e70be70c184
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'baarspo.ru', which is flagged as suspicious. Although no scripts were explicitly extracted, the PDF structure and embedded URI suggest an attempt to redirect the user to a malicious site, likely for phishing or to download a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/aws?utm_term=reiner+and+bertholdt+transformation+dub PDF link annotation
    • https://cdn.sqhk.co/devisofage/ghf1hev/toss_em_all_game_review.pdfIn PDF document text
    • https://cdn.sqhk.co/kinanekoxo/iilWZic/dipup.pdfIn PDF document text
    • https://cdn.sqhk.co/bevizewo/gjgpijS/seloxavopusokile.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • https://s3.amazonaws.com/najubu/71437098320.pdfIn PDF document text
    • https://s3.amazonaws.com/widetunipet/wow_cataclysm_dungeon_erfolge_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/pulavokaxe/zanugebelisa.pdfIn PDF document text
    • https://s3.amazonaws.com/bulalowisu/foloduwe.pdfIn PDF document text
    • https://s3.amazonaws.com/varoximu/american_heart_association_healthy_diet_guidelines.pdfIn PDF document text
    • https://s3.amazonaws.com/gixirojozogufux/backbeat_pro_2_user_manual.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c155.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC155 4680 bytes
SHA-256: 299bf2065c2a21959231d3d07cfe2dcbb0112ba58bc866b2d88825991c24877c
font_01_sfnt_off0000d1d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD1D0 5292 bytes
SHA-256: 15aab8a5f58ab79a938e809ce26ff64793ae88672d59e2abf514fedd9b24937e
font_02_sfnt_off0000e39a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE39A 5736 bytes
SHA-256: 40ca5c34dba2cbb76644c2ce8ee2bdfc275ca3c0c988d0127320b2a00362ee69
font_03_sfnt_off0000f1ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1ED 9444 bytes
SHA-256: 39b309828843b577c510d8ec3cb2568399dc87f08c05c60f9c6319f89314cfec

Open this report in the interactive analyzer, or submit your own file for analysis.