Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ac74b7c461b89f2…

MALICIOUS

PDF

80.1 KB Created: 2021-04-06 08:03:35 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: edde12f4a7456255d1aa9276f8b6313b SHA-1: 85ea021c72fd317e9da61888c6a5768049e69f36 SHA-256: 6ac74b7c461b89f2e6d31fbb9c2ccc97204c2fe45eef46686384ef0cf2b51938
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URL pointing to 'soxebez.ru', which is likely used to deliver a malicious payload or conduct phishing. The PDF structure and embedded content suggest it is designed to trick users into visiting this external resource.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=mary+chilton+descendants
    • http://sellamorem.com/atto_mobility_scooter_user_manualb0iya.pdf
    • http://linza.media/my_samsung_smart_tv_wont_connect_to_the_internetom5e4.pdf
    • http://sejerodetupumil.medianewsonline.com/speak_english_books_free_download.pdf
    • http://kovuzaxaf.medianewsonline.com/66933346873.pdf
    • http://astropsychology.site/descargar_purble_place_para_tablet_androidyxp2k.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://f904ef53-caa1-4f0f-8a97-c50675c03ece.filesusr.com/ugd/2f8cea_718e57e526a1468191cbe814425eea99.pdf?index=true
    • https://s3.amazonaws.com/zidosozawok/commercial_beverage_cooler_repair.pdf
    • http://xifeloj.onlinewebshop.net/caracteristicas_de_la_familia_lamiaceae.pdf
    • https://uploads.strikinglycdn.com/files/45ec9298-8fb2-4861-9781-a74e9663cecf/canon_powershot_sx110_is_compatible_memory_cards.pdf
    • https://uploads.strikinglycdn.com/files/cb230215-6497-431e-a528-6269fe5a2a3c/83195938600.pdf
    • https://s3.amazonaws.com/feborobegibew/innova_scanner_3140_manual.pdf
    • https://s3.amazonaws.com/zaxawetawupo/maya_angelou_books_in_order.pdf
    • http://mubodadekutaxim.atwebpages.com/banivajajax.pdf
    • https://fa3f2985-242d-4a4c-93c0-6adbfb259eaf.filesusr.com/ugd/8dbe7a_8915f0095edc42dbad9b275bb3c8ee79.pdf?index=true
    • https://459ec6dd-5b69-4322-a182-74abbfaa0e48.filesusr.com/ugd/221eaa_a2b5e35db0bd4d38a3ed96160894ac07.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5b40b2c8-6463-48df-b6ba-c8674005c320/63127498807.pdf
    • https://2b81f3f0-3f46-42ff-87a7-5865dd96cd3c.filesusr.com/ugd/fb41f9_50374e2d14a54e15b30c4f7b01edb318.pdf?index=true
    • https://s3.amazonaws.com/vetamedisoz/rewujigemomelukutugemag.pdf
    • https://s3.amazonaws.com/fomudebipefasu/33767303892.pdf
    • https://s3.amazonaws.com/gewuwasi/87699645227.pdf
    • https://s3.amazonaws.com/juliziwojatige/bajarang_song_mp4.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000fc6c.bin
da704127b413a9a63ae95b8230f55c3d7caf960c0c52d46364d5f3e4e5af8b3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFC6C 5136 bytes
font_01_sfnt_off00010dea.bin
167838e34b69aeff83f420feb572671ffdc20ec14f6330d848e62ef2578b85a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DEA 10784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.