Malicious PDF — malware analysis report

Static analysis result for SHA-256 718332abd094c849…

MALICIOUS

PDF

77.7 KB Created: 2021-03-28 06:31:32 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 69307c7653dec7aecb54e3f8d4a0d9cd SHA-1: 76df929f31bb38fcc5597cc7417e597ff8292dc8 SHA-256: 718332abd094c849281d725463dd02f45070a8e3bf2f1489aeef3ac5f25b53ab
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. It contains an embedded URI pointing to 'soxebez.ru', which is presented as a download link for 'adobe flash player'. This suggests a phishing or social engineering attack aimed at tricking users into downloading malware disguised as a software update.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=adobe+flash+player+11.+8+android+apk PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4380214/normal_600a14395a0b8.pdfIn PDF document text
    • http://amorexpo.com/wakipexexaxec70.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4404285/normal_6048261e8905a.pdfIn PDF document text
    • http://dragonflysagewellness.com/transition_words_for_fifth_grade_writinga95ln.pdfIn PDF document text
    • http://lnstagram-helping-centre.com/gmail_logout_of_all_devices_from_phonebkib0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4366639/normal_60307826cc016.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4477163/normal_6049c02e6ce6d.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://uploads.strikinglycdn.com/files/5f182e8f-503d-4a5b-8556-3a922643de47/adding_and_subtracting_fractions_with_integers_worksheets.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8f3100f6-6879-43d4-8651-b5b4ba1ff0f7/59506164958.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/30846514-5aba-4ba2-ae33-3ded22540c87/the_history_of_love_book_free_download.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8e46a727-eb98-4d6d-b242-7f417afee559/how_do_i_program_my_ge_6_universal_remote_without_codes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c6afb465-37d2-444a-a10b-11575519b347/how_long_to_learn_visual_basic.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fb27aeba-038b-4c8a-85ba-69d3dcfff946/gusulukigelud.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/bb6094d3-aeea-45b7-b453-f3aa23eb995b/26790762412.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/999b0a2f-11da-4c3e-bed2-f55414972f34/73477073090.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/3e1fff0f-c7ed-439a-a5ac-47afd5dc447a/35285208765.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d5270300-c7da-461c-a8c2-b37f0c7b7f97/1000_phrasal_verbs_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5753d8c0-225f-492e-b1a0-fb996f31e0fa/80943913625.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/5593b107-3828-48fc-a7c0-249110dbcfb5/22258582449.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/cb2bf322-51b0-45f8-a6f9-3dca74694f91/how_to_increase_brightness_in_casio_calculator_fx-991ms.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/a6fcb3fd-6b1c-4551-b124-c1f27f5bc76b/snow_white_with_the_red_hair_episode_5_season_1.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/20478a27-3151-49d4-97dd-52331bbb0bd7/sodupuv.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4e54e71b-317a-48d2-b956-aaeba532506c/what_is_the_arc_trainer_for.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e435.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE435 5408 bytes
SHA-256: a6eaae8f630c5744ea1e7d6fdf089b35ca1fc88c5aec73d69c0916183313fb79
font_01_sfnt_off0000f68c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF68C 10752 bytes
SHA-256: c49896646bf0e879a94d9f9acd2de04fcdc47eebac8216d4b7c39f5d0738746e
font_02_sfnt_off00011b62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11B62 4324 bytes
SHA-256: ff5f0ef16caf3e97cd1984b3a03ea88e11eab8cf63d2ee006085a4b9995833f3

Open this report in the interactive analyzer, or submit your own file for analysis.