Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1b5a75de8738245…

MALICIOUS

PDF

74.9 KB Created: 2021-04-01 13:35:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: eb82e52861f7a2655c14c66bd6a90e10 SHA-1: aa74024e2f34c23258ae59e26d8f1fa91e137828 SHA-256: d1b5a75de8738245e1bb61582ba95ac72bdec0e764c83c5b0291b69a9d655f26
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic firing for a large number of external links, with one prominent link pointing to 'baarspo.ru'. The ML classifier and ClamAV also flagged this PDF as malicious, specifically as a phishing trojan. The document body, though partially corrupted, suggests a lure related to a book PDF, which is a common tactic for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/aws?utm_term=pensar+rapido+pensar+despacio+libro+completo+pdf
    • https://mazogerivajusem.weebly.com/uploads/1/3/4/3/134341978/5179969.pdf
    • https://cdn.sqhk.co/tizalenifo/1ieOhgG/ansible-_vault_windows.pdf
    • https://roboxojepuz.weebly.com/uploads/1/3/4/2/134235986/7e0380be.pdf
    • https://cdn-cms.f-static.net/uploads/4500674/normal_605457241b03a.pdf
    • https://cdn.sqhk.co/baxorurifina/2CPhhjj/underseat_storage_toyota_tundra.pdf
    • https://delovamubikener.weebly.com/uploads/1/3/4/7/134707073/6011287.pdf
    • https://cdn.sqhk.co/mamevugixej/jaAifhb/26326470697.pdf
    • https://static.s123-cdn-static.com/uploads/4369632/normal_5fd0420a7caac.pdf
    • https://cdn-cms.f-static.net/uploads/4449618/normal_6042f5fce2465.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/37916ece-114f-4561-8456-8d15eabbd00d/logitech_g700s_mouse_software.pdf
    • https://uploads.strikinglycdn.com/files/ecc60212-88b9-4cc1-9d24-9cd78edb1e8f/lexokabimezuvijorofav.pdf
    • https://e8b83640-91e4-44a0-a69f-c2468797902f.filesusr.com/ugd/ee4a13_0343cb3dc625459391d328d6a23794d8.pdf?index=true
    • https://f4a80ce2-0a24-44e2-aff7-13c87a434ee9.filesusr.com/ugd/ace063_14e3ce5f75d64012ad316051949629c1.pdf?index=true
    • https://ee897e78-a157-4eb5-8a47-d615096087a2.filesusr.com/ugd/113e89_e8247edfd5e1459eb607dc9fe88c2b69.pdf?index=true
    • https://uploads.strikinglycdn.com/files/7488cb0d-79ba-434f-a22d-7514e0130d68/jinuwowemino.pdf
    • https://e9abb47e-19e5-4ec2-9f3c-2aa4e6f2bf0a.filesusr.com/ugd/92be99_cf31dcb7aba64ec582ebe2a4f08f0bf7.pdf?index=true
    • https://1ae094b9-110d-4377-a83c-911b29edd90d.filesusr.com/ugd/d5eada_0504d89ed284469ea504139fbb95bb63.pdf?index=true
    • https://uploads.strikinglycdn.com/files/98a9dc54-3198-4a99-b4d2-6a30916455c7/60668595523.pdf
    • https://7c5e2310-e79b-429e-9f4a-70471a43dcce.filesusr.com/ugd/8ec1ef_4d24c8ddf5c3438c978d76a680cacfba.pdf?index=true
    • https://fdb0147f-387d-4908-9c93-1ccdb5bf775f.filesusr.com/ugd/aea2e0_f75e955a38a447e0b8acf826afe71184.pdf?index=true
    • https://uploads.strikinglycdn.com/files/3333bdc1-5e21-45bd-b65a-e529ae8a85c5/intellitone_pro_200_probe_cable_map.pdf
    • https://204833c8-abda-4421-8777-5048ee7dd919.filesusr.com/ugd/e30b7a_9a9c95abe7044d77915f0f016181462c.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5e0.bin
0db4c0d373cda8823b7a32732d5cc9d1b6e103266075f52cfea4d9fed6a33a1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5E0 5444 bytes
font_01_sfnt_off0000f84e.bin
129bbb3db4fc7f7c8f1798b751fe1302c99c8e628d1501adcb683769faaab114		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF84E 11568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.