Malicious PDF — malware analysis report

Static analysis result for SHA-256 4554b2edb6aa5156…

MALICIOUS

PDF

76.3 KB Created: 2021-04-04 08:34:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1e4b5fea0384d025f3a59c9cbcbbeff6 SHA-1: b220a4d09a0b561949fe85599d6432361b5fe128 SHA-256: 4554b2edb6aa515637905d2cf875bcfe41f3f3eda689a94bbff90bfefa378dfa
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to 'baarspo.ru', which is likely the malicious destination. The document body, though heavily obfuscated, appears to be a lure related to a popular book title, suggesting a social engineering tactic to trick the user into visiting the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8092

Heuristics 3

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=the+playbook+barney+stinson+pdf+espa%25C3%25B1ol+mega
    • https://cdn.sqhk.co/bamebuxi/gk0Ejf1/free_red_and_blue_background_images.pdf
    • http://copyright-services-us.com/51624718597mbsoj.pdf
    • http://nowuzoti.iblogger.org/63613797392.pdf
    • http://sokobumoxagug.scienceontheweb.net/hoerner_aerodynamic_drag.pdf
    • http://usacarins.com/does_better_business_bureau_do_anythingszxtb.pdf
    • http://ditoterelutas.sportsontheweb.net/chemical_bonding_short_notes.pdf
    • http://lazadacostumercenter.com/deltran_battery_tender_plus_near_mecs1d9.pdf
    • http://bonifacy.site/29886622249nfz0g.pdf
    • http://vasuxarogaxatix.iblogger.org/wound_care_education_institute.pdf
    • https://cdn.sqhk.co/dikapagoloza/UShjfgd/moto_rider_go.pdf
    • https://cdn.sqhk.co/rotonoba/igqxchi/39344157115.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/8b2c2ba9-2d18-4e52-a584-3e33ed67d91e/nobijisaragaxatage.pdf
    • https://uploads.strikinglycdn.com/files/ddbb055a-0994-4421-8ccb-7ad4ea581eda/ranoroj.pdf
    • http://misukejijixuke.epizy.com/nosetukikimafarujavabipe.pdf
    • https://uploads.strikinglycdn.com/files/fe2d8e11-3df2-45c7-8329-6642b4d6d344/plc_programming_courses_online_uk.pdf
    • https://uploads.strikinglycdn.com/files/87c396f6-bec7-4be2-be02-323c3a05b7c5/rerudurik.pdf
    • https://uploads.strikinglycdn.com/files/1549e813-fce3-430d-9f1e-7f2d88b3b51d/76632648437.pdf
    • https://uploads.strikinglycdn.com/files/a9a21acb-560d-4546-a52e-0cc5f7785147/tozaxoxozogidetexobino.pdf
    • http://sifusavukaga.rf.gd/58771023087.pdf
    • http://zojofat.epizy.com/povapawelovezakuguxuleji.pdf
    • http://nopugorib.onlinewebshop.net/43715563654.pdf
    • https://uploads.strikinglycdn.com/files/e6daddf1-e849-417d-a2b0-aa6b0c21ee2a/boss_gt_1000_core_price.pdf
    • http://tibamupebunod.atwebpages.com/rebifap.pdf
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012252.bin
63ee3d0ebc530c5e8d5c30c70a8dae9a43b16c0d108f23395d2ddde2446751cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12252 5924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.