Malicious PDF — malware analysis report

Static analysis result for SHA-256 685cb996825c08df…

MALICIOUS

PDF

79.6 KB Created: 2021-04-04 00:08:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 304f47f87264f07dc5e30ad299209e6e SHA-1: 23e3666947d0e980a77c2bef6b50f356db1df3f6 SHA-256: 685cb996825c08df01ec399709d96eba3f23bb5aa61ba27976c05e87169be272
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a specific ClamAV detection name of Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0. It contains an embedded URI pointing to a suspicious domain, soxebez.ru, which is likely used to host a phishing page or deliver a second-stage payload. The document body is heavily obfuscated, but the presence of external URIs and the overall detection suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/aws?utm_term=i+can+see+white+blood+cells+in+my+eyes
    • http://yachts-4-sale.com/pubupesuvlktg8.pdf
    • http://ferejupaxebul.iblogger.org/motu_patlu_tamil_cartoon_free.pdf
    • http://fruitslope.online/ac_dc_greatest_hits_mega0vks5.pdf
    • http://lg-copyright.com/las_venas_abiertas_de_america_latina_ensayoyv7es.pdf
    • http://how2clever.com/toyota_forklift_parts_manualvtccd.pdf
    • https://damosekim.weebly.com/uploads/1/3/4/2/134235752/cb821.pdf
    • https://laxedojopepab.weebly.com/uploads/1/3/4/8/134896069/jidejovutev.pdf
    • http://qwonder.space/29654120390jq0f0.pdf
    • https://rebopugosoge.weebly.com/uploads/1/3/5/3/135346619/333991.pdf
    • http://apple-fruit.space/zubep0u9qp.pdf
    • http://razvivatel.blog/is_there_a_movie_of_the_mysterious_benedict_society5kczf.pdf
    • http://shopeuro.pro/329642818873jp7i.pdf
    • http://trynon.xyz/jalekosozekuzuwidid771l.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/tokafanawa/29661376177.pdf
    • https://12350a4d-732a-4148-85a7-4fa27f2a77ec.filesusr.com/ugd/17beed_75b8fd8ac0264e0a9193f2f4e8413dba.pdf?index=true
    • https://s3.amazonaws.com/vifusupegiza/amendments_in_1973_constitution.pdf
    • https://s3.amazonaws.com/dixaleko/27353085417.pdf
    • https://a0d6205d-24bd-49e6-be0b-b96d1aba8433.filesusr.com/ugd/e54fc7_4f01317a86694fc6ade8db7a3d8bc1d4.pdf?index=true
    • https://ebbb41b5-b8b7-4bfc-9e1b-23e79ad93844.filesusr.com/ugd/5eba67_e46ff0756c2f4758b216c428bb7c6f9e.pdf?index=true
    • http://vokuloramemi.epizy.com/curso_de_direito_penal_bitencourt.pdf
    • http://dinijeti.rf.gd/63371800138.pdf
    • https://11f44e1d-c86f-4be6-baa1-90970e7c24f5.filesusr.com/ugd/a298ce_6460bb3a63084e23b1cf7fed38d17601.pdf?index=true
    • https://s3.amazonaws.com/sugowubuf/penipiximoxegixomilogeb.pdf
    • https://0e01c86c-6ad9-43de-bc04-b8819f410213.filesusr.com/ugd/73c254_990d87d04b3c4095b7628bd8fe1e6762.pdf?index=true
    • http://bevamixebigal.epizy.com/fluke_test_report.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ee8b.bin
b47d671209d297eade859a8ad6d243d159988e0c3767e4ea9e49c74bad8ffbd6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xEE8B 5144 bytes
font_01_sfnt_off0000ffe3.bin
677f0c242c83a61a734a407ea0df9b2264a41adf3e88e90a360d68f6969e872d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFE3 10140 bytes
font_02_sfnt_off00012285.bin
ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12285 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.