Malicious PDF — malware analysis report

Static analysis result for SHA-256 5cb60679c7b2c90a…

MALICIOUS

PDF

114.3 KB Created: 2021-04-01 00:37:20 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-30
MD5: 2290dc3f0ab6e8192def1b07400353c1 SHA-1: 6a3155944478ec6f1f6c80103edc661c7c683c4d SHA-256: 5cb60679c7b2c90a741a58010dad919d8e40e0b84bdaad85ed378cc6d82c8f7f
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with one prominent link leading to 'baarspo.ru'. This URL, combined with the heuristic 'PDF_SEO_LINK_FARM' indicating a large number of external links, suggests a malicious intent to redirect users. The ClamAV detection and ML classifier further support its malicious nature, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7546

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/award?keyword=carnatic+music+book+in+telugu+pdf PDF link annotation
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://uploads.strikinglycdn.com/files/7f341793-544f-40fd-884b-8e37ed121f28/que_significa_la_aparicion_de_moretones_en_el_cuerpo.pdfIn PDF document text
    • https://s3.amazonaws.com/bulikowexunepov/boba_fett_wallpaper_for_android_phone.pdfIn PDF document text
    • https://f039f7e9-c7fa-441d-bf3d-2f0e35d6be10.filesusr.com/ugd/80685d_b9c9f718c0c24e9ea1a160e4202abd50.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/236d5e41-068f-411a-8d9d-d1e863930766/the_winds_twelve_quarters_summary.pdfIn PDF document text
    • https://s3.amazonaws.com/dipafuxe/civ_6_rise_and_fall_leader_guide.pdfIn PDF document text
    • https://63aa7d51-6c54-48cc-ac87-b710a0da19c3.filesusr.com/ugd/c8d394_b7bec89c0fef4ffd8592a805d60cb73f.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/zerejibixupav/lafapevinokoz.pdfIn PDF document text
    • https://s3.amazonaws.com/jeworurowam/97893366756.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d597e859-55e8-47b3-bf3e-c66325ee9eee/wudekeso.pdfIn PDF document text
    • https://d21da297-2d1c-4020-882f-059d99c29dc9.filesusr.com/ugd/3724a2_a69802b09e394444b19c5e066c7db5e0.pdf?index=trueIn PDF document text
    • https://uploads.strikinglycdn.com/files/1542d0a0-c641-4705-ac62-b742a3abc883/99763504297.pdfIn PDF document text
    • https://s3.amazonaws.com/fadadedezeker/adda247_books_free.pdfIn PDF document text
    • https://s3.amazonaws.com/rawesaragegugar/best_logo_design_software_for_mac.pdfIn PDF document text
    • https://s3.amazonaws.com/bepukuba/adobe_indesign_cc_2015_kuyhaa.pdfIn PDF document text
    • https://s3.amazonaws.com/dapekufoxiraku/silaxesaf.pdfIn PDF document text
    • https://0c1adbbe-b65a-4c28-9da2-87cea21e0636.filesusr.com/ugd/496951_1539e6e73651451dbb5cd9878d7e26fa.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/kufazete/boboiboy_the_movie_2_mp4.pdfIn PDF document text
    • https://6974b9b2-fc2a-4e9b-9495-84ff65489eb7.filesusr.com/ugd/395280_4bc10c4d635d4791b857603cd3e43b47.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/bepukuba/gemumetitovexofozuxi.pdfIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011665.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11665 5584 bytes
SHA-256: 017d64c17dd667e30aec8b9066304c5c5028265fe0c575463b98f327b7654c39
font_01_sfnt_off00012946.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12946 68304 bytes
SHA-256: e6962cb92d071c8eab271ca6e37d2ba8fc13701c5d7fbbac866bc3fce8883a15
font_02_sfnt_off0001a2f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A2F7 10604 bytes
SHA-256: 5942acc9096e0d7a0905ea3e336d31cb6de05a66e1402e521c71b6f56715ad3d

Open this report in the interactive analyzer, or submit your own file for analysis.