Malicious PDF — malware analysis report

Static analysis result for SHA-256 fec1e1b324348645…

MALICIOUS

PDF

93.3 KB Created: 2021-04-10 08:24:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-23
MD5: cf424a6e5ba5266929a1e03cd5ac5e79 SHA-1: 2b8875ddbca0089ddae6c0677cb9e265eaa9f1d3 SHA-256: fec1e1b3243486450228dd25694364d7abc5dd84d67d2cff96cc4dcec56ee1d9
126 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains numerous embedded URLs, with one prominent URL pointing to 'baarspo.ru', suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains keywords related to audio equipment, likely serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://baarspo.ru/strik?utm_term=tascam+dr+40x+vs+zoom+h4n+pro PDF link annotation
    • http://nupewijanetari.medianewsonline.com/neget.pdfIn PDF document text
    • http://gexulogoben.sportsontheweb.net/afcat_2020_2_notification.pdfIn PDF document text
    • http://mifirejetevina.getenjoyment.net/how_to_reset_my_roku_box.pdfIn PDF document text
    • https://vojerured.weebly.com/uploads/1/3/3/9/133999986/wotufuro-lidatow-dakuzuxa.pdfIn PDF document text
    • https://sekowuwumobof.weebly.com/uploads/1/3/5/3/135394032/bf270dbc294b51.pdfIn PDF document text
    • https://zujogomute.weebly.com/uploads/1/3/1/4/131483029/8833953.pdfIn PDF document text
    • https://rakurewirusemew.weebly.com/uploads/1/3/4/0/134017151/d9b124a3.pdfIn PDF document text
    • http://zokiwedilar.mypressonline.com/download_brunner_and_suddarth_s_textbook_of_medical_surgical.pdfIn PDF document text
    • https://mavipevawifuduv.weebly.com/uploads/1/3/4/5/134598931/8635347.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://vimitafukufes.rf.gd/gofaniwakus.pdfIn PDF document text
    • http://zuzofigub.rf.gd/xafotemepo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b5c8a345-30dc-462d-ae1a-7ad63f5c789c/16007211784.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1ffb878f-610d-44f2-8fb8-c3883add19bb/how_to_wear_baby_forward_facing_in_ergo_360.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/99631a82-d86b-4159-9e77-9e9136fa69ea/21171917210.pdfIn PDF document text
    • http://bedopevidorofi.myartsonline.com/14001888644.pdfIn PDF document text
    • http://luzadewo.epizy.com/quotient_rule_examples_and_answers.pdfIn PDF document text
    • https://8546b567-499d-44cb-812b-f4cb210fa0cc.filesusr.com/ugd/1f0b74_a2a608ad8fdf43759353291ebb7691de.pdf?index=trueIn PDF document text
    • https://45b0b119-5f8c-43e7-b437-4e12d17c1c81.filesusr.com/ugd/3826db_24cb9f8bb533446e858ff7549da7acb9.pdf?index=trueIn PDF document text
    • http://ledaruwevegoxu.onlinewebshop.net/the_positive_philosophy_of_auguste_comte.pdfIn PDF document text
    • https://a1c9bafd-2917-4c1b-b79c-a4b44a941470.filesusr.com/ugd/f0f215_d62e90cb883d45e691a1231df8ba385c.pdf?index=trueIn PDF document text
    • http://kitijowu.rf.gd/80371552714.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0ddc29b3-2674-402d-856b-b7c4e3c8b7c5/23511199880.pdfIn PDF document text
    • https://cf176ec6-4820-456b-adf9-61e5f06c968f.filesusr.com/ugd/43d598_582dc8eba7ed4b748fe9875c23ddd501.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012d21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D21 5636 bytes
SHA-256: 14cee872bcec34a8360c1c01a982675ca786f1dd0507778958297d6671d22670
font_01_sfnt_off00014030.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14030 11720 bytes
SHA-256: f8e69d26d16f774a2a40598f9de9dce64289cf3043cb4e9e679810804dbe8a66

Open this report in the interactive analyzer, or submit your own file for analysis.