PDF malware analysis — malicious · c28e4a8c11cf5e83

MALICIOUS

PDF

80.3 KB Created: 2021-03-09 17:15:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-12

MD5: aaf5a6fcf312849f67ad6c78b4e95dc5 SHA-1: 3daf55bc92cb59648ad44a3490b8d3e010606d57 SHA-256: c28e4a8c11cf5e8345b47207b652fd768064bfb4aa9117dd9a52c4afd5f5dc9b

134 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. The document contains an embedded URI pointing to 'baarspo.ru', which is likely a malicious domain used for phishing or malware distribution. The presence of urgency lures further supports a phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM

Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://baarspo.ru/strik?utm_term=dell+optiplex+790+ram PDF link annotation
- https://cdn-cms.f-static.net/uploads/4450256/normal_6042e098b6703.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4403282/normal_5ff1051b5c9e5.pdfIn PDF document text
- https://cdn.sqhk.co/mitugejaxel/UBgdShf/heroes_of_71_mod_game_download.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4404290/normal_6022baab7c6e0.pdfIn PDF document text
- https://cdn.sqhk.co/vovawumusa/RgihhiN/boo_boo_meaning.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4427821/normal_600370a456d3c.pdfIn PDF document text
- https://cdn.sqhk.co/rukefazox/jFfbhew/bike_racing_3d_free.pdfIn PDF document text
- https://cdn.sqhk.co/begokaxawip/afhjXLd/boston_college_basketball_head_coach_salary.pdfIn PDF document text
- http://tixajisegu.22web.org/john_deere_hpx_gator_carburetor.pdfIn PDF document text
- https://cdn.sqhk.co/bebofuwe/xvrhdhe/booking_calendar_contact_form_wordpress_plugin.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4449984/normal_5ff75afc2e522.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/56a9cb57-176b-41bd-aa10-cca230224019/78637624769.pdfIn PDF document text
- https://s3.amazonaws.com/vovabagubajegeb/19126502886.pdfIn PDF document text
- https://2c9641c8-5874-4869-9b94-f1378e60aa6b.filesusr.com/ugd/efc1f6_5180bcb174a64cf4af768ed8d56da4ce.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/nuvukivaxiren/what_are_some_fun_demonstration_speech_topics.pdfIn PDF document text
- https://2a4c341d-9af7-4f89-b48a-1b926ad6ced7.filesusr.com/ugd/dd6616_3fd8864fb3fb448da66167ec574fe53e.pdf?index=trueIn PDF document text
- http://mutaluwuvekigo.rf.gd/tekiponabipe.pdfIn PDF document text
- https://03ca3561-abfe-48ca-9b59-b1b2b77f8126.filesusr.com/ugd/1af49e_19d0a76cc2db4b5896d8ed0a5b34bcce.pdf?index=trueIn PDF document text
- http://xalovizavana.rf.gd/android_auto_bmw_2_series.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5cb6c7bb-3401-43bd-a34a-48f9cba40e1d/56075545676.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9d30630e-02aa-4147-9490-14099b3b7088/gosajoxeguledigilis.pdfIn PDF document text
- http://zonatenitisa.rf.gd/horde_leveling_guide_undead.pdfIn PDF document text
- https://90ff81fc-98d9-4e53-96a3-aaa5c1c2042e.filesusr.com/ugd/bb5aff_8e49a426f4424b40a7b1b79bf5110a0a.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000fa6d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFA6D	5232 bytes
SHA-256: `2b53ff155cf38a485c9fa1136d5f1257491c81fbb92b6ec81d0388b15b7239b6`
`font_01_sfnt_off00010c36.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10C36	11452 bytes
SHA-256: `4327b75dfdce9f583b54893feb3bc67271aeee7ee0f1ac4bd67f30b3375d5af9`

Open this report in the interactive analyzer, or submit your own file for analysis.