Malicious PDF — malware analysis report

Static analysis result for SHA-256 277fda8f6253d202…

MALICIOUS

PDF

77.5 KB Created: 2021-03-09 10:24:36 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-06-13
MD5: a193cd41d45cd9af4f9751ff52579098 SHA-1: 966300011e100965e6ddfdeabb039607b9e6d58b SHA-256: 277fda8f6253d202f8ecacbb2a67b1f6191b2deee4142ae33bcd1b9ea5d7ca09
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URL pointing to 'soxebez.ru', which is likely used to deliver a malicious payload or conduct phishing. The document body, though heavily obfuscated, suggests a lure related to a 'worksheet'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=clouds+and+what+they+mean+worksheet PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4475720/normal_5feafec1bab9a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4488582/normal_5fd9759f6ec6d.pdfIn PDF document text
    • http://dejasis.iblogger.org/gaxananijomuzologuga.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4450907/normal_6002dc48cfde4.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/a80b1a58-d519-46c4-8a8e-15eb0829cfc7/85923243392.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b0a69b1-562f-448d-8f19-c105cf321ce0/how_hard_is_aws_certification_reddit.pdfIn PDF document text
    • https://s3.amazonaws.com/mejawiwomak/tawozunutemopezew.pdfIn PDF document text
    • https://s3.amazonaws.com/dikobepibelun/65737724358.pdfIn PDF document text
    • https://s3.amazonaws.com/samopakamefap/atex_zone_1_android_tablet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/27f4b35c-cecb-4430-8e15-6e44108c051e/traxxas_stampede_2wd_brushless_kit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7d08927e-ee62-471f-88d8-3fcea062a2dd/pubojojuzolesaf.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/920f402e-8475-4fd3-b123-8c4313325fc3/why_isnt_my_samsung_tv_picking_up_wifi.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8996d24d-78ef-4448-b985-5697a40a637e/rufelen.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/097d3344-ac74-4668-8ce5-e89c8c22f029/10th_class_english_book_2020.pdfIn PDF document text
    • https://s3.amazonaws.com/geraromu/aws_cloudformation_stack_template_body.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ded50892-83d8-4116-b4ba-8c1913ada55f/80204713373.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/7c8e2b23-1d31-4863-bc27-285e01b29f4f/how_many_trained_first_aiders_do_i_need.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/914d7ef5-1bd3-4632-a76b-03874ceb1f84/better_than_before_synonym.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/55e752e3-c016-49e6-8a65-47cccdd221ad/domaliziwisuj.pdfIn PDF document text
    • https://s3.amazonaws.com/jamuluvuvava/76259336147.pdfIn PDF document text
    • http://dufapojemuju.epizy.com/72789602500.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8821c33c-5d88-4f8b-8351-b5fd8afb7444/safety_not_guaranteed_movie_ending.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb198de0-5783-4fb0-b3a1-2237be0146f4/wisop.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/0a712beb-d21e-4bf1-a768-51abd7695cee/que_ao_de_vehiculos_se_pueden_legalizar.pdfIn PDF document text
    • http://jagutebi.epizy.com/book_like_48_laws_of_power.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f381.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF381 5228 bytes
SHA-256: 0722e26a95fd3afc4183b2811b793b2040a4243a7ed2f3120b38361119e333d1
font_01_sfnt_off0001052e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1052E 10476 bytes
SHA-256: bc2c525cb8aff0186122b7ce83c14c5f48f61c753eeecc69783126c038927cac

Open this report in the interactive analyzer, or submit your own file for analysis.