Malicious PDF — malware analysis report

Static analysis result for SHA-256 7badc769c5d72753…

MALICIOUS

PDF

88.8 KB Created: 2021-03-07 03:51:38 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-05-22
MD5: 4ec2290acb66399451a4a76ca0807bc1 SHA-1: 9c3a86d96fdad24c5d0d6a13229bab17d9f88a43 SHA-256: 7badc769c5d72753a78ef7521607754ae41a8f034dcd6fd7ef2ace97a88340a4
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'soxebez.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to a tool manual, intended to trick users into clicking the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=black+and+decker+planer+7696+type+1+manual PDF link annotation
    • http://uggi-ugg.com/zunun8pacu.pdfIn PDF document text
    • https://cdn.sqhk.co/besiwowegin/ZjbPHid/pebiwoxokajumalu.pdfIn PDF document text
    • http://herss.space/excell_pressure_washer_xr2600_pump2v5k8.pdfIn PDF document text
    • https://cdn.sqhk.co/verexoleki/igQYbja/51720623182.pdfIn PDF document text
    • https://cdn.sqhk.co/vumulevezuf/6cPieu6/31827753621.pdfIn PDF document text
    • http://lnstagramcopyrightmanagement.com/grammaire_facile_du_francaisugzhb.pdfIn PDF document text
    • https://mubujibazakob.weebly.com/uploads/1/3/3/9/133986275/vowef.pdfIn PDF document text
    • http://meetsalon.xyz/books_in_order_dan_brown8vb4m.pdfIn PDF document text
    • https://jipubegu.weebly.com/uploads/1/3/1/0/131070098/4503382.pdfIn PDF document text
    • https://lifulufo.weebly.com/uploads/1/3/1/3/131379971/kowinifaseg.pdfIn PDF document text
    • https://zejebamusij.weebly.com/uploads/1/3/2/3/132302936/tilitu-desufewogu-xoxesizewev.pdfIn PDF document text
    • https://zokibiruxe.weebly.com/uploads/1/3/5/3/135326092/6166c0.pdfIn PDF document text
    • https://cdn.sqhk.co/javeduner/fiugd92/jailbreak_escape_craft.pdfIn PDF document text
    • https://cdn.sqhk.co/vamunidibu/idJjcjc/bsnl_online_recharge_portal_kerala.pdfIn PDF document text
    • https://wijinopupog.weebly.com/uploads/1/3/5/3/135323990/e245f475870562.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/lupuvogotog/camera_app_hd.pdfIn PDF document text
    • https://s3.amazonaws.com/fotepopunaj/why_is_my_washing_machine_not_getting_hot_water.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/777b1315-ab97-47ab-982c-838845b2ee9e/kilerunefurumunipobit.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f840f973-4d2c-4764-a716-d75b6dd3196a/how_to_set_time_tissot_t_race_touch.pdfIn PDF document text
    • https://s3.amazonaws.com/xasovewipeje/lutazurariw.pdfIn PDF document text
    • https://s3.amazonaws.com/fakuguvil/14066595038.pdfIn PDF document text
    • https://s3.amazonaws.com/vuliwisuwig/how_to_improve_manual_dexterity_for_dental_school.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/b6110efa-2c65-43a6-850d-11a474837901/80715540601.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9b9b9623-e5ac-45af-bb90-73a1ef289a4b/pufawobus.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6b70c36-c31e-4086-ab01-67dcc3afbe9f/burley_minnow_weight_limit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00011bfa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11BFA 5696 bytes
SHA-256: dfed7ed5a29d7309735388a23d4bbc269e08cc3d3e40880ec4ddeb3e306a4784
font_01_sfnt_off00012f68.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12F68 11208 bytes
SHA-256: 89a98a23d9765c10fef54b309777abbd8c2e4fb9e6487b467a9c94b23d6c10a4

Open this report in the interactive analyzer, or submit your own file for analysis.