Malicious PDF — malware analysis report

Static analysis result for SHA-256 23ebb53948277d28…

MALICIOUS

PDF

78.6 KB Created: 2021-03-05 23:25:21 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a4ba6747e48482ea754ca7232117399d SHA-1: 1c6a969d78b149cd2ac8b82aa0088559b74eb6db SHA-256: 23ebb53948277d286c0e26093214dff74c2182a647059daf8f62b8a12b00983b
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URL pointing to 'soxebez.ru', which is likely used to host or deliver a secondary payload. The presence of a 'download button' heuristic further supports the phishing or malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=maax+spa+481+manual
    • https://static.s123-cdn-static.com/uploads/4506170/normal_5fe4173f29c44.pdf
    • https://cdn.sqhk.co/xugumewaz/VX2hgJL/15464981813.pdf
    • https://cdn-cms.f-static.net/uploads/4488558/normal_602997ee6173f.pdf
    • https://cdn.sqhk.co/fapetemiji/iNehf5e/63658422919.pdf
    • http://helpcopyright-service.com/dixit_cards_game55i2w.pdf
    • http://getplafond.xyz/emotional_intelligence_2.0_audiobook_mp3h11ug.pdf
    • https://kowagazobavov.weebly.com/uploads/1/3/0/8/130874359/4264228.pdf
    • https://cdn-cms.f-static.net/uploads/4365580/normal_5fd659f2b0216.pdf
    • https://cdn-cms.f-static.net/uploads/4484093/normal_60321c31b4cef.pdf
    • https://cdn.sqhk.co/zesonixiv/ajiXhj2/1052100838.pdf
    • http://fertpin.online/equivalent_fractions_year_5_worksheetyjzl6.pdf
    • https://gorejirulikem.weebly.com/uploads/1/3/4/7/134738880/pibutano_mesasetodelosiw_xirim.pdf
    • http://shoop-fo.ru/chemdraw_professional_freeuhgf0.pdf
    • https://cdn.sqhk.co/tazurusubiz/hcBjgRM/my_first_book_of_tagalog_words.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/vinejivunitego/81256335796.pdf
    • https://s3.amazonaws.com/kevava/chicago_bulls_uniform_font.pdf
    • https://s3.amazonaws.com/zugutixe/82129485085.pdf
    • https://s3.amazonaws.com/jipowumat/happy_birthday_song_remix_ringtone_free.pdf
    • https://s3.amazonaws.com/natewared/16278275181.pdf
    • https://s3.amazonaws.com/xujitezu/zurawovu.pdf
    • https://s3.amazonaws.com/pusolefosex/41861947304.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e2cd.bin
200a689749fb88aa063675ff7ef2c5a950ae992bdbf38082b1197bc2993ddad5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE2CD 5276 bytes
font_01_sfnt_off0000f4cd.bin
028e208ec19b2e9b11e47a90bd3f5c28f90aac1c4b4127ab5c518133f8e19b3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF4CD 10284 bytes
font_02_sfnt_off0001183c.bin
2bac0d7445fe5768be44ad7a0943804bdfa4a71883f7703ca85e4e7e3f76abd8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1183C 16100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.