Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6a933c6ebe84180…

MALICIOUS

PDF

90.2 KB Created: 2021-02-16 07:30:23 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-11
MD5: 64dd80559aa13ca5803f776c1ad40eda SHA-1: 5f7a52431bc74669c06cec1cfe951fc5d2bf3545 SHA-256: e6a933c6ebe841809c973dcd7f04bfd32adcb46bc0940148d8f39d27d7073495
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF that contains an embedded URL, which is flagged as malicious by ClamAV and ML classifiers. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the document is designed to trick the user into downloading an archive, likely by presenting a fake download link. The embedded URL points to 'baarspo.ru', which is likely the distribution point for a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=el+hobbit+3+version+extendida+espa%25C3%25B1ol+latino PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4393763/normal_5fe06fc165752.pdfIn PDF document text
    • https://gatodagimisosog.weebly.com/uploads/1/3/1/3/131379801/b6bd9c.pdfIn PDF document text
    • https://cdn.sqhk.co/xagaxubibiz/bgikbKr/football_live_scores_results_and_fixtures.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4466154/normal_5fe17dc2b4f33.pdfIn PDF document text
    • http://covid-19online.site/22105621789gk6sg.pdfIn PDF document text
    • https://cdn.sqhk.co/xuxodokoju/3LfSjya/cup_stacking_song.pdfIn PDF document text
    • http://idealica-columbia.site/73902855738ukojj.pdfIn PDF document text
    • https://zugowexilib.weebly.com/uploads/1/3/5/3/135349829/6512211.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369166/normal_600d7ab0bb6c9.pdfIn PDF document text
    • https://cdn.sqhk.co/lukulobu/aq70V2f/vopax.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4471488/normal_5fde10988a164.pdfIn PDF document text
    • https://babulavired.weebly.com/uploads/1/3/0/7/130775389/2110fa5.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4472763/normal_5ffda6e5c36c6.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4427287/normal_60225c1e06a6d.pdfIn PDF document text
    • http://lefijuf.iblogger.org/waruzexudasuz.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4387816/normal_5fe347008d2b6.pdfIn PDF document text
    • http://study-english-05.site/islamic_marriage_contract_templatekjtkz.pdfIn PDF document text
    • https://reviniwixex.weebly.com/uploads/1/3/1/4/131407974/714969.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://luselobek.epizy.com/96461223496.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed11.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xED11 4840 bytes
SHA-256: 94f9944d182a240f23d08a2232376af825af97cb6f25b0d2b9021faf08f1604d
font_01_sfnt_off0000fe0d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE0D 5648 bytes
SHA-256: a99e4408bb553189df0dacfdbb8a00e905eed735ff64254526b76615a88d6fe7
font_02_sfnt_off000110f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x110F2 2444 bytes
SHA-256: f62c8ee4646a24964508f314c32503c6f4f3bd7c7845080111ab3ccd1149bfaa
font_03_sfnt_off00011bb8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BB8 11712 bytes
SHA-256: c13884bb9c07b2292cf3b231d92d61ef5a620d303a833587b07f237e92e9f73a
font_04_sfnt_off0001422d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1422D 16224 bytes
SHA-256: 4a5c36e67cb0cf2203a49150b964b9f69f6d5e64ef997a84c22f8d018363a7af

Open this report in the interactive analyzer, or submit your own file for analysis.