Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a1634154fcb1e0f…

MALICIOUS

PDF

77.8 KB Created: 2021-03-22 15:26:49 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d1ee147443046bb362ca4072615f26e6 SHA-1: 422f271f585dd94c8c3a125bb1127340a45819c0 SHA-256: 1a1634154fcb1e0f058e6424b8478dd340f2c415efab2306a71a18cb0b002551
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by a machine learning classifier and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'https://soxebez.ru/123?utm_term=gantt+chart+template+excel+2010', which is likely used to deliver a secondary payload or redirect the user to a phishing site. The document body, though heavily obfuscated, contains text related to 'Gantt chart template excel 2010', suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=gantt+chart+template+excel+2010
    • http://fakusanevose.22web.org/what_causes_a_kenmore_washer_not_to_drain.pdf
    • https://cdn-cms.f-static.net/uploads/4495040/normal_604ca9231b102.pdf
    • https://cdn-cms.f-static.net/uploads/4369150/normal_6016b48241bfa.pdf
    • https://kolijegidixut.weebly.com/uploads/1/3/1/3/131379325/7724946.pdf
    • https://vixadabunukup.weebly.com/uploads/1/3/4/9/134902839/3082033.pdf
    • https://static.s123-cdn-static.com/uploads/4387924/normal_5ff329972249f.pdf
    • http://podifodosej.scienceontheweb.net/95371680313.pdf
    • http://lulamugateso.mypressonline.com/caamo_industrial.pdf
    • http://lufexaxoxak.mygamesonline.org/beginner_piano_sheet_music_book.pdf
    • https://static.s123-cdn-static.com/uploads/4411481/normal_5fe4da7b89fb2.pdf
    • https://wabezapodila.weebly.com/uploads/1/3/1/4/131437306/tutowipalotekelexejo.pdf
    • http://zonerokemub.getenjoyment.net/total_gym_tv_discount_code.pdf
    • http://xizapataruxeku.mygamesonline.org/oceanography_for_upsc.pdf
    • https://wozogerodinanu.weebly.com/uploads/1/3/4/4/134498855/zodonugutesiroz-zimazedurin.pdf
    • https://dojenamolusojow.weebly.com/uploads/1/3/4/8/134868247/fabezaduwepose.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://pusapovewazigu.onlinewebshop.net/jesigowokoronojol.pdf
    • http://zitegarapopufis.rf.gd/accused_no_1_tamil_hd_movie.pdf
    • http://sigedasubaduvep.rf.gd/capitalismo_informacional_neoliberalismo.pdf
    • http://moxadokikubod.onlinewebshop.net/energia_eolica_en_costa_rica.pdf
    • http://vanepozimor.rf.gd/71338149180.pdf
    • http://pawepeg.atwebpages.com/how_to_use_humidifier_on_furnace.pdf
    • http://wipadafefuxasi.onlinewebshop.net/nagiwobuxovirugi.pdf
    • http://podepabat.rf.gd/78923114929.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f0d6.bin
bf7565620c87c9fcddea4ddef521456de8b628cfd473da09032b0f09ea0568fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF0D6 5420 bytes
font_01_sfnt_off00010327.bin
20c703cd08aeb05143cfc8c8a2e7744e9aca207110f0b84476c8dd0906f9670b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10327 10788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.