Malicious PDF — malware analysis report

Static analysis result for SHA-256 25755972cdddc095…

MALICIOUS

PDF

81.7 KB Created: 2021-03-28 11:29:54 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: a1b64cc9f7f5c33f291469eec61c6ca0 SHA-1: 2660fa176ad9b0d48c8d56901b0fd6ae4eca7e72 SHA-256: 25755972cdddc0958592f7c6b993afb2e56504db3d0cc9bc9eafb34a9257e518
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'soxebez.ru', which is likely a malicious domain used to distribute malware or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to 'editor apk mod', indicating a social engineering attempt to trick users into downloading software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=editor+apk+mod
    • https://static.s123-cdn-static.com/uploads/4464529/normal_5fcd700f8dcb0.pdf
    • https://renobikedasel.weebly.com/uploads/1/3/4/8/134897329/8822411.pdf
    • https://cdn-cms.f-static.net/uploads/4496381/normal_60223c602560d.pdf
    • https://sulasaboxa.weebly.com/uploads/1/3/4/7/134767053/gogafuvu-sumuwonamu-xumov-josupufibij.pdf
    • https://jutarufuro.weebly.com/uploads/1/3/0/7/130775772/373e738.pdf
    • http://inostrana.com/education_board_dhaka_result_sheet2tjeu.pdf
    • http://fsbsiod.com/povadofanisejupusawitohut71.pdf
    • https://cdn-cms.f-static.net/uploads/4467927/normal_60239d177cadc.pdf
    • http://goodxday.xyz/panasonic_phone_number_customer_servicefd658.pdf
    • https://ronabamipiboti.weebly.com/uploads/1/3/4/5/134598089/sabumixu_mifan_bunutifizanexiw_pafefulivodiw.pdf
    • http://lavka-karamel.ru/fepejopusopozufesutu59uu.pdf
    • https://cdn-cms.f-static.net/uploads/4366321/normal_600f5334b5f95.pdf
    • https://cdn-cms.f-static.net/uploads/4410985/normal_605a990ce5d71.pdf
    • https://dubuzosokiboxof.weebly.com/uploads/1/3/1/1/131163723/1486463.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/eda4fb11-826f-4e45-a593-52462422dcbb/11769384457.pdf
    • https://uploads.strikinglycdn.com/files/ad5ee3ef-f487-4b0f-8d12-f86797c3a480/satagixadelowekizutu.pdf
    • https://uploads.strikinglycdn.com/files/7b2acf08-337a-4e95-8f07-638997341006/befizanu.pdf
    • https://uploads.strikinglycdn.com/files/be6bfb1b-d023-462b-a932-020ebc08fef6/96707768340.pdf
    • https://uploads.strikinglycdn.com/files/0ebe8299-b21a-4b1a-b9ca-2bb864f213d4/att_u_verse_tv_codes_remotes.pdf
    • https://uploads.strikinglycdn.com/files/b29da443-e3da-4d3d-8018-20bcaf2eb3f1/is_a_phd_worth_it_in_psychology.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df9d.bin
8d2085edb7dca0a6d885ab4c01e25d6118398c78010771515c349c005d731198		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF9D 4916 bytes
font_01_sfnt_off0000f047.bin
526768791a275c05ba760670f00bab646594b2e2b945f6453e4c0bbf37c71d28		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF047 22632 bytes
font_02_sfnt_off00012380.bin
9af6fc3bf9d751f70540aea0fa47faa159a3604992cda23d2adcda3ffc5346b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12380 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.