Malicious PDF — malware analysis report

Static analysis result for SHA-256 8791afbd33cab8ef…

MALICIOUS

PDF

68.7 KB Created: 2021-02-21 23:49:10 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 27923a0a65382e5a2f193c7349e083be SHA-1: e5553b982233723b83f248b115bdce54c192c21f SHA-256: 8791afbd33cab8ef1837a69ab13a51f01d5e137961e705b325f2985e88f298d1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The ML classifier and ClamAV heuristics strongly indicate this PDF is malicious, specifically flagged as a phishing trojan. The document contains multiple embedded URLs, with the primary one being `https://baarspo.ru/strik?utm_term=what+does+it+mean+when+somebody+says+burning+the+midnight+oil`. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection suggest the PDF is designed to redirect users to malicious sites, likely for phishing or to download further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=what+does+it+mean+when+somebody+says+burning+the+midnight+oil PDF link annotation
    • http://vuxuxabuj.iblogger.org/cross_check_two_excel_spreadsheets.pdfIn PDF document text
    • http://gifozazupu.iblogger.org/26045609853.pdfIn PDF document text
    • http://xezojugudapele.iblogger.org/i_am_stronger_than_before_quotes.pdfIn PDF document text
    • http://kogefidol.iblogger.org/bacterial_artificial_chromosome_vector.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4444357/normal_5fca17c54c9ba.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4412588/normal_60209d0960cc5.pdfIn PDF document text
    • http://roguvopupo.22web.org/39147143256.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4476601/normal_5febc37ae5331.pdfIn PDF document text
    • http://gakivako.iblogger.org/molecular_models_bonding_lab_answers.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4480753/normal_5feb1beee9c0b.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4426679/normal_5fdf9e77820f6.pdfIn PDF document text
    • http://kozupuj.iblogger.org/husqvarna_riding_mower_wont_start_just_clicks.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/tifuwuw/75076099657.pdfIn PDF document text
    • https://s3.amazonaws.com/jopomodilamego/52527311474.pdfIn PDF document text
    • https://s3.amazonaws.com/xeropizuwe/import_excel_spreadsheet_stata.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cca7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCCA7 5584 bytes
SHA-256: fe5fdbeb0222b5d87837227332962751230afe592de430aeca6cf5dd9f4ebc52
font_01_sfnt_off0000df91.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDF91 11380 bytes
SHA-256: 780d5011115f1f60bbc93d91394fd9e15663bf95c1bd58efd173f2fd9178a614

Open this report in the interactive analyzer, or submit your own file for analysis.