Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc9b8b392a2fa39e…

MALICIOUS

PDF

80.7 KB Created: 2021-04-16 14:45:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 22b3964124b2029c42e2ce4367d14aa4 SHA-1: 785f324f7658615f01d2d417974ae07a92264b02 SHA-256: cc9b8b392a2fa39e4c77a46e0cd30573a4a94556d43ca6acb2e27662b89c9a9c
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and ML classifiers indicated a high probability of maliciousness. It contains an embedded URI pointing to 'baarspo.ru', which is likely a phishing or malware distribution site. The document body, though heavily obfuscated, appears to be a lure related to a popular streaming service, consistent with phishing tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=why+is+fresh+off+the+boat+not+on+netflix
    • http://shmelev.pro/realtek_hd_audio_manager_missing_in_control_panelhx9lo.pdf
    • http://boviriso.22web.org/3d_action_games_apkpure.pdf
    • http://lojuxaga.mywebcommunity.org/summary_of_twilight_new_moon_book.pdf
    • http://hurricane1.space/xuvefoxelan4npq.pdf
    • http://revodegasiger.sportsontheweb.net/online_adobe_acrobat_editor_free.pdf
    • http://huaweistoreukr.xyz/shadowrun_20th_anniversary_edition3k94b.pdf
    • http://goodsfor.life/bugera_v22hd_infiniumjv2z1.pdf
    • http://hookup153.online/nuliki7wu9x.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://28932ed2-21d9-4123-99cb-fcff0aac4472.filesusr.com/ugd/cc089a_ecad729d778b41c78ec607d1f0458ec1.pdf?index=true
    • https://s3.amazonaws.com/pukaridimupo/colonization_game_strategy_guide.pdf
    • https://uploads.strikinglycdn.com/files/7b1e9745-46dc-4b4d-9189-f5028d0bdd74/86275574643.pdf
    • https://a2876ee3-c470-454a-91e2-e108d831033a.filesusr.com/ugd/e8dba5_f38180a6e2fe438eb506e5b390afa7c3.pdf?index=true
    • https://s3.amazonaws.com/vonuxagupeduze/chef_and_puppet_tutorial.pdf
    • https://uploads.strikinglycdn.com/files/afe5cff3-6bc7-4a37-a03d-eac3db6a526e/types_of_text_structure_7th_grade.pdf
    • http://zugagib.atwebpages.com/32257524261.pdf
    • https://uploads.strikinglycdn.com/files/201fb1b9-2c85-47b2-b9b4-36ed4f246e64/baxodakogaratuli.pdf
    • https://s3.amazonaws.com/kagedatabujo/past_simple_affirmative_exercises_perfect_english_grammar.pdf
    • http://xiwozoget.atwebpages.com/87047915162.pdf
    • https://s3.amazonaws.com/rivazixexuguri/vudatodumajupawojatutose.pdf
    • https://95c758d6-fd33-43c6-b5d0-f1f55e07e946.filesusr.com/ugd/cb0188_cca06ed7066444b9a424dce5b2a66b58.pdf?index=true
    • http://nekipusixewid.epizy.com/bccl_company_full_form.pdf
    • https://s3.amazonaws.com/pegozegi/dictionary_english_free_for_mobile.pdf
    • http://jokosen.atwebpages.com/33525996184.pdf
    • https://uploads.strikinglycdn.com/files/203f3ba7-680c-4085-89db-9736882d2139/john_deere_z225_transmission_parts.pdf
    • https://uploads.strikinglycdn.com/files/c92bddb9-70ae-47eb-9082-db7c6f7a9438/nakewenivalozizarud.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fe1a.bin
b303b7e8854b4e70627eee15d264f56e3c0aa7a339b4edf49183fcc37409790f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFE1A 5176 bytes
font_01_sfnt_off00010fce.bin
81b43c814dda5b7b7b2364fe740abf20db650ae32e1290c7aaf872af6c3bbc37		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10FCE 10816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.