Malicious PDF — malware analysis report

Static analysis result for SHA-256 dec230738d35c72e…

MALICIOUS

PDF

81.7 KB Created: 2021-03-13 16:54:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 545cf9b83d4e861246ee454f26f8fb8c SHA-1: daad7650391ecc4fc4a2ad24e31979fa65fddaa1 SHA-256: dec230738d35c72e338521e928b5e63a6e0d7a0fc0feb0d666f5cbd658f1497f
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an external URI pointing to 'baarspo.ru', which is likely part of the phishing lure. The document body, though heavily obfuscated, suggests a 'Yahoo fantasy basketball cheat sheet' theme, indicating a social engineering pretext to drive users to the malicious URL.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/123?utm_term=yahoo+fantasy+basketball+cheat+sheet PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4475212/normal_6007b9c232b5f.pdfIn PDF document text
    • http://wonnaturila.space/los_crimenes_de_la_calle_morgue_edgar_allan_poe_personajes7mi42.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4366005/normal_5ff4bd1154d82.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4470985/normal_601dccdf6c370.pdfIn PDF document text
    • https://cdn.sqhk.co/zonelatu/ggQheBA/atalanta_formazione_titolare_2018.pdfIn PDF document text
    • http://ductsunlimitedins.com/mizesu30dir.pdfIn PDF document text
    • http://vowujebotoza.mywebcommunity.org/dibujo_de_cara_de_nio_para_pintar.pdfIn PDF document text
    • http://itanah.space/dewalt_titanium_drill_bits_reviewwchth.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4496828/normal_600f158316614.pdfIn PDF document text
    • https://cdn.sqhk.co/tuwetebep/id2gjje/xcom_enemy_unknown_android_apk.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4446507/normal_5fcf14ef7b585.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/fejenijovekozu/fusion_360_direct_link.pdfIn PDF document text
    • https://e3835a62-9136-4977-a4f2-b11bebb7289a.filesusr.com/ugd/7ad284_745316f96b2b4972a2177a842fe0a325.pdf?index=trueIn PDF document text
    • https://s3.amazonaws.com/xamibudasagas/ziwofazekerevivenosobula.pdfIn PDF document text
    • https://e4034479-4ead-418b-af8c-5be8dc72bdbe.filesusr.com/ugd/1e8759_8e98028215cd457c8106ec89a011dede.pdf?index=trueIn PDF document text
    • http://duxepivol.myartsonline.com/how_to_connect_a_brother_printer_that_is_offline.pdfIn PDF document text
    • https://s3.amazonaws.com/vibuvomomuv/1686757020.pdfIn PDF document text
    • https://s3.amazonaws.com/tuxexi/reasonable_doubt_full_movie.pdfIn PDF document text
    • https://s3.amazonaws.com/wizomoravazub/6053217313.pdfIn PDF document text
    • https://45ed8376-e832-497f-ab20-0a31924dc5db.filesusr.com/ugd/4b7290_b68f234dd70c464d98b13fc270aab75a.pdf?index=trueIn PDF document text
    • https://03df18d0-0a94-4077-8b44-1f3cf8b7c870.filesusr.com/ugd/23a6c3_ad8cd1a8641a49b9841283163d73a1b0.pdf?index=trueIn PDF document text
    • https://b01ec662-dec5-4f54-b977-8708717d6054.filesusr.com/ugd/07e02c_4e5741b57fee46258d088998cab9b8cc.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f675.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF675 5140 bytes
SHA-256: 87fbc2d4b5fcf8f78269541349f4556c4eaac243d615478d3a4c81d95f380e0e
font_01_sfnt_off000107f9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107F9 2152 bytes
SHA-256: 1f650f29bd4b17a4b1f1c43355b06fc27fa6e44fd49f48c1bb78734a31739586
font_02_sfnt_off0001114b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1114B 11152 bytes
SHA-256: b8536260342b252997e45e8d3b0db295abc4e43983c7733ac56f91272da27478

Open this report in the interactive analyzer, or submit your own file for analysis.