Malicious PDF — malware analysis report

Static analysis result for SHA-256 d19bb5fea44e42ee…

MALICIOUS

PDF

86.5 KB Created: 2021-03-15 22:46:32 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1d36227819d91b97abf1e05191233140 SHA-1: e20748363f1f5df5ee93e57560fcb8d01c5ccdc5 SHA-256: d19bb5fea44e42ee53e3f1ffd7fe617337c3875c09b02ef92d3f6dbed7ccee92
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document was flagged by a machine learning classifier and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'baarspo.ru', which is likely part of a phishing or malware distribution scheme. While no scripts were explicitly extracted, the nature of the detection and the embedded URL suggest an attempt to redirect the user to a malicious site, potentially for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=denzel+curry+songs
    • http://sputnews.com/36428855007p5klf.pdf
    • http://bitcoinchat.fun/longman_phrasal_verbs_dictionary35szp.pdf
    • http://titanof-filtr.ru/altec_bucket_trucks_for_salenb4i1.pdf
    • http://importants.space/4587508916u7e8z.pdf
    • http://qlemelest.online/what_does_3m_stand_for_on_face_mask1i81g.pdf
    • http://wasareni.22web.org/41749641598.pdf
    • http://marketitaly.info/observation_inference_worksheet_middle_school9o76h.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/6de4364e-03a5-436f-be3e-7f991c81940c/lmites_de_funciones_trigonomtricas_ejercicios_resueltos.pdf
    • https://uploads.strikinglycdn.com/files/025d1334-f4f1-4e03-9418-cb5f43f0224e/dafebuw.pdf
    • https://s3.amazonaws.com/fekaduvopigab/puvemudedezilomofusa.pdf
    • https://s3.amazonaws.com/lekizopiloref/sonic_sega_all_stars_racing_transformed_controls.pdf
    • https://uploads.strikinglycdn.com/files/e88f37fe-8b31-4098-8dca-5156fc62ad91/the_complete_works_of_swami_vivekananda_volume_1.pdf
    • https://uploads.strikinglycdn.com/files/da6a4a43-4396-424d-994b-5187d61c576e/how_to_turn_food_waste_into_compost.pdf
    • https://s3.amazonaws.com/wejuvono/aa_12_step_workshop_and_study_guide.pdf
    • https://s3.amazonaws.com/tokit/81078717804.pdf
    • https://uploads.strikinglycdn.com/files/ebe1b581-6aad-4975-82b8-6108c1bd4f51/difuximezowig.pdf
    • https://uploads.strikinglycdn.com/files/8d5e00c9-aa3f-44b6-8196-8dc39b4501b4/62654662867.pdf
    • http://bozudob.epizy.com/69875662156.pdf
    • https://uploads.strikinglycdn.com/files/41668ccf-789e-4d9b-95f7-280d4da2af98/82902945896.pdf
    • https://s3.amazonaws.com/somamere/adobe_photoshop_for_macbook_pro.pdf
    • https://uploads.strikinglycdn.com/files/8427dcc6-5082-4d10-b3ef-904f7682bc63/verbs_worksheet_1st_grade.pdf
    • http://ligumawi.epizy.com/faxoxujamovemizenixezajan.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000112c4.bin
4df490125efbf1f941b2babdf7b80277568a4e951b7499142f1cc66469599a36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112C4 4908 bytes
font_01_sfnt_off000123a2.bin
36abc404d83f7d8fb64fe5c385d65c535185f9a55a9b1013dc71d3a75e4e3071		 pdf-font-stream PDF embedded font (sfnt) at offset 0x123A2 11736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.