Malicious PDF — malware analysis report

Static analysis result for SHA-256 63f535def88b5d56…

MALICIOUS

PDF

70.2 KB Created: 2021-03-08 15:42:11 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: cb4f558d19e4f197e6ba149bb2411151 SHA-1: fdc6594da8cfc198e6db07e3d991e7625e011be6 SHA-256: 63f535def88b5d5695b0894accf011d695cbaf3c8ed8680b8ef75a0ae5da76e1
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, with one heuristic specifically identifying a 'PDF link farm' pointing to various PDF documents. The primary malicious URL, 'https://baarspo.ru/strik?...', is likely used to redirect the user to a phishing or malware distribution site. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as a phishing trojan.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=theory+and+problems+of+probability+and+statistics+schaum%2527s+outline+series PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4366949/normal_5fde89cc74686.pdfIn PDF document text
    • http://pro-komp-master.website/kokatewowasepiwiriburpi837.pdfIn PDF document text
    • http://itali-big.space/fiwopuxigasiraleroxbdy2r.pdfIn PDF document text
    • http://usersdeviceprotectionservice.site/i_can_read_system_thailandyi3oe.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4408721/normal_5fef66cdae7db.pdfIn PDF document text
    • http://cuzinfo.ru/75959159706rgsvg.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4478125/normal_5fca7d009f2d6.pdfIn PDF document text
    • https://cdn.sqhk.co/gojelonub/SLgcheb/60896011324.pdfIn PDF document text
    • https://cdn.sqhk.co/dorodidur/xkifsRu/batteries_plus_car_battery_replacement.pdfIn PDF document text
    • http://kartaidatodemeleri.com/cowboy_bebop_ost_downloadokdof.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/xakapudakadu/cara_menambah_ram_laptop_acer_aspire_one_722.pdfIn PDF document text
    • https://s3.amazonaws.com/pukaridimupo/86355245239.pdfIn PDF document text
    • https://8c77b9b7-c39b-43d6-9406-6086bd2c0f93.filesusr.com/ugd/ee6770_fe014274e9e94bfea6ca0ca1a00c143f.pdf?index=trueIn PDF document text
    • https://badbb018-ab4e-499b-b788-960949b82e3d.filesusr.com/ugd/4f4c56_15ed67dd496b47c18c43cea3664b736a.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/luropiw/timeline_google_sheet.pdfIn PDF document text
    • https://0dc5016f-38c0-4e11-84f4-4717e3ef4ec7.filesusr.com/ugd/4fd84c_31f17ea8241c42428debb073535e4333.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/jujadodedaruxix/oxid._it_cain_abel_windows_10.pdfIn PDF document text
    • https://s3.amazonaws.com/tezofuretejom/77920240298.pdfIn PDF document text
    • https://s3.amazonaws.com/dazutun/22219730938.pdfIn PDF document text
    • https://s3.amazonaws.com/goneduzum/pigudobokinivun.pdfIn PDF document text
    • https://s3.amazonaws.com/murudute/bodenapoz.pdfIn PDF document text
    • https://s3.amazonaws.com/mijumomub/3495774176.pdfIn PDF document text
    • https://307a23dc-bb60-4906-9a68-69e45957aa19.filesusr.com/ugd/d2057d_a4637cf9b33744a3ae43b34e7d46a3b4.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/wisuw/todifidazulukujajewaripip.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d476.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD476 5620 bytes
SHA-256: 551c35a7591add175c3ddab297bf82a0667fd159c1d6d9c82e43b72e9475dfe6
font_01_sfnt_off0000e770.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE770 10348 bytes
SHA-256: 614b7e02e70f39766be4217e79c6072683a982a671988c823c865e1038cd3f7c

Open this report in the interactive analyzer, or submit your own file for analysis.