Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f92c71f2375411d…

MALICIOUS

PDF

81.0 KB Created: 2021-03-23 04:56:40 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6cae4b96f11bc35b4239b330baad9828 SHA-1: 7fcfff7d60e104ded9b2f6dab8e0afcb5be411d8 SHA-256: 3f92c71f2375411d48c9c4a42fd4b86757ad8fa28e8f23ffe9acdfa51a3fbb98
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'soxebez.ru', which is likely used to host a phishing page or download a secondary payload. The document body, though heavily obfuscated, suggests a lure related to 'accounting chapter 9 study guide part 2', aiming to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=accounting+chapter+9+study+guide+part+2
    • https://static.s123-cdn-static.com/uploads/4379960/normal_6007613bcbc0a.pdf
    • https://static.s123-cdn-static.com/uploads/4383566/normal_5fce1171d3e0c.pdf
    • https://cdn-cms.f-static.net/uploads/4424933/normal_60268209cc5f1.pdf
    • http://subuxiwubemew.getenjoyment.net/gokixegoxoxiku.pdf
    • https://cdn-cms.f-static.net/uploads/4384160/normal_6028a9eb8a623.pdf
    • https://cdn.sqhk.co/bijozugetav/jjzSPjh/7097544368.pdf
    • https://cdn.sqhk.co/papusabefo/af8mHjb/virtual_girlfriend_app_download.pdf
    • https://cdn-cms.f-static.net/uploads/4500200/normal_601b19fe8195e.pdf
    • http://zaxegod.getenjoyment.net/2006_yamaha_v_star_1100_classic_owners_manual.pdf
    • http://zevewidojodot.mywebcommunity.org/43153095967.pdf
    • https://cdn-cms.f-static.net/uploads/4455902/normal_601f0e163030f.pdf
    • https://cdn-cms.f-static.net/uploads/4470207/normal_6044641608061.pdf
    • https://cdn.sqhk.co/palezubifo/BLJjagh/book_folding_love_heart_template.pdf
    • https://cdn.sqhk.co/kosaboze/DijlPsx/problem_solving_gcse_maths_questions.pdf
    • http://sabizomunutaf.22web.org/35607641990.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://uploads.strikinglycdn.com/files/a86a9d54-690f-474f-808d-4194e7875d2d/71056200635.pdf
    • https://uploads.strikinglycdn.com/files/0610b30a-9ac9-4318-900a-5041ef894616/36650312062.pdf
    • https://uploads.strikinglycdn.com/files/d1ad184f-0b19-418f-851a-5bc21d6d2631/how_long_is_aircraft_maintenance_tech_school.pdf
    • http://jimatisejur.rf.gd/bonasom.pdf
    • http://xixupokolaxusuv.epizy.com/cadastral_surveying_textbook.pdf
    • https://uploads.strikinglycdn.com/files/d44ecb51-3585-4285-b855-d1b64c39fa30/how_to_calculate_initial_velocity_from_absorbance_and_time.pdf
    • https://uploads.strikinglycdn.com/files/7001d03b-195c-48e1-a7c5-c1dfc0838162/sazavek.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee9a.bin
eecff5ff25ca28f37a19f38dc5e2b254433bd1cdf41801652db2b6adca704806		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE9A 5564 bytes
font_01_sfnt_off0001017f.bin
730345981b3a5926775f753d69a79e3e7651251e50c8f68e1887cf8753f7ba88		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1017F 11880 bytes
font_02_sfnt_off000127d7.bin
b50a2106bf82917db0cd3cf88f63c5e8cc3298b343ace5cffc591b35df33d24c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x127D7 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.