Malicious PDF — malware analysis report

Static analysis result for SHA-256 78ad252e20bd2a2d…

MALICIOUS

PDF

81.2 KB Created: 2021-04-14 22:45:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-22
MD5: 26bcb6597b08ac6d7289147419ec5fdd SHA-1: 7a120c2cdfec97fad2cd62b64ce8487547c8a644 SHA-256: 78ad252e20bd2a2db5a67fddf3ea371d43c4d7ce60bd114713e017a284ce1a79
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The sample is a PDF document that contains numerous external links, many of which are designed to appear as legitimate documents but likely lead to malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of generated links, and the 'CLAMAV_DETECTION' confirms it is recognized as a phishing trojan. The embedded URL 'https://baarspo.ru/strik?utm_term=tp+link+wr841n+pppoe+settings' is the primary IOC, likely serving as a redirect to a phishing or malware distribution site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=tp+link+wr841n+pppoe+settings PDF link annotation
    • https://cdn.sqhk.co/bikegola/gctihib/kofidop.pdfIn PDF document text
    • https://cdn.sqhk.co/bomemenun/gehQnih/archery_country_austin_texas.pdfIn PDF document text
    • https://cdn.sqhk.co/zenegiwowi/ke6hfIC/wilefo.pdfIn PDF document text
    • https://cdn.sqhk.co/janonaset/jhjihip/83487690271.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/bufexa/ruvavado.pdfIn PDF document text
    • http://xazabivi.epizy.com/10835395456.pdfIn PDF document text
    • https://s3.amazonaws.com/bubeto/juz_30_download_muzammil.pdfIn PDF document text
    • https://s3.amazonaws.com/zowejunef/charlotte_s_web_script.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9a99ad7b-a00f-4d72-9e13-e173be860aaa/60990203191.pdfIn PDF document text
    • https://s3.amazonaws.com/sosupejuxofedo/gst_annual_return_format.pdfIn PDF document text
    • https://409b2d23-5c1d-402e-97df-26c0da9299b0.filesusr.com/ugd/2e3d42_63bb75b8bca042b8b3547f6c42a24706.pdf?index=trueIn PDF document text
    • https://4b4b92a8-4ac5-4030-97d5-af0917f8c077.filesusr.com/ugd/0251f0_4cf88577ed9541d1bed7c7b9f0f00de5.pdf?index=trueIn PDF document text
    • http://xofisoroj.rf.gd/yamaha_dgx_650.pdfIn PDF document text
    • https://s3.amazonaws.com/lopeteb/37309200034.pdfIn PDF document text
    • https://s3.amazonaws.com/salade/47582502012.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/619e4aa9-ac9e-4ba6-83cc-9b6bc285a5cb/is_minecraft_the_island_a_series.pdfIn PDF document text
    • https://s3.amazonaws.com/pokorevalaxex/formic_acid_wastewater_treatment.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/610c0c0c-e212-4d7c-9c76-d531a4090d82/difference_between_gdp_and_national_income.pdfIn PDF document text
    • https://d54d55f4-8004-4613-9f19-7b96cbed0ae7.filesusr.com/ugd/ce4b32_fd2e128e739448a38d9bbaa87291773a.pdf?index=trueIn PDF document text
    • https://e37fb4d6-fac4-4cb1-96d9-cce2dae532e5.filesusr.com/ugd/ed2751_f4b11600159242259b299a2451d1da36.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/vitelitubovuluj/affray_sentencing_guidelines_council.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f163.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF163 5004 bytes
SHA-256: 497c92c54dd66a4b8bd926d0a1568712ae817b23a857656102c4cf565b216b4d
font_01_sfnt_off0001028b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1028B 11488 bytes
SHA-256: f968c0436239ca5d3d97c6085581d72b8920fae9232a87bcb78d400c482a9fea
font_02_sfnt_off00012988.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12988 4324 bytes
SHA-256: 1062cd8ddf90f4344fa193b395386d5669df1a952e5759311ca261a71931f361

Open this report in the interactive analyzer, or submit your own file for analysis.