Malicious PDF — malware analysis report

Static analysis result for SHA-256 7dd3cbb5720d7d78…

MALICIOUS

PDF

79.8 KB Created: 2021-04-04 17:16:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 31b038f9b3bccd7b559830c6e02d0e7e SHA-1: 7867eea51ebfca0efcd7af38a1c7b19ecbc04575 SHA-256: 7dd3cbb5720d7d78dda748cae046ff63a158c7e9cc58c81366e55f8ca36c87d4
156 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, with a critical heuristic identifying it as a link farm designed to direct users to other sites. The primary external URI points to 'soxebez.ru', a domain associated with malicious activity. ClamAV also detected this file as 'Pdf.Phishing.Trojan', indicating a phishing or malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=ge+profile+counter+depth+french+door+refrigerator+manual
    • https://cdn-cms.f-static.net/uploads/4368245/normal_5fdc4c796b5b3.pdf
    • https://cdn-cms.f-static.net/uploads/4388165/normal_601f3a3f169bc.pdf
    • https://cdn-cms.f-static.net/uploads/4393361/normal_600d6db09d351.pdf
    • https://xudomulur.weebly.com/uploads/1/3/4/0/134040538/rozada.pdf
    • http://zutelotojenexop.getenjoyment.net/detect_text_in_image.pdf
    • http://fegiroxopirez.sportsontheweb.net/sinonatid.pdf
    • https://xanivumukil.weebly.com/uploads/1/3/1/8/131856382/7930681.pdf
    • https://cdn-cms.f-static.net/uploads/4411501/normal_603ede268bacf.pdf
    • http://xiwesesakuvel.medianewsonline.com/nigolifi.pdf
    • http://kopalirigel.mypressonline.com/car_bill_of_sale_fillable.pdf
    • https://gagivoxiw.weebly.com/uploads/1/3/5/9/135991060/5a131aea2d60b.pdf
    • https://xekekulok.weebly.com/uploads/1/3/1/8/131857590/wuroz.pdf
    • https://cdn-cms.f-static.net/uploads/4449768/normal_60593c3031f30.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/1e59a7d8-f788-404c-9373-97f6a685ab18/can_u_cook_a_ham_in_a_roaster_oven.pdf
    • http://zijiwaras.onlinewebshop.net/vakas.pdf
    • https://s3.amazonaws.com/nuvukivaxiren/horizontal_line_android_xml.pdf
    • https://uploads.strikinglycdn.com/files/aeaf60b7-1394-4a66-bcc8-0b1288b137da/how_to_make_margaritas_simple_syrup.pdf
    • https://uploads.strikinglycdn.com/files/d1b3c826-4281-4987-aa82-4f03fce45ff0/pamawipaxi.pdf
    • https://uploads.strikinglycdn.com/files/9991fa47-a9b6-4d63-92bb-ca2f950253d5/how_to_set_my_marathon_watch.pdf
    • https://s3.amazonaws.com/woneketelak/5821762630.pdf
    • https://uploads.strikinglycdn.com/files/b8d81a68-f8b2-420e-a9ab-c9a46a03a61d/2005_dodge_ram_1500_power_window_problems.pdf
    • https://uploads.strikinglycdn.com/files/a190f8e4-bd5b-42d0-aab8-d72762308acb/magnetek_impulse_g_mini_manual.pdf
    • https://uploads.strikinglycdn.com/files/771a20fd-0fde-4b11-9def-b108add6ffef/how_can_you_tell_how_many_atoms_are_in_a_molecule.pdf
    • https://uploads.strikinglycdn.com/files/322db459-6b3f-4990-82ae-658cd268c03f/10253525916.pdf
    • https://s3.amazonaws.com/lomogas/68402468492.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f9dc.bin
cdbd8961630df185eccc29a7f1ee1463b595cc98dc0baacd4b52a1fe17603ac2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF9DC 5424 bytes
font_01_sfnt_off00010c28.bin
74c0d12c8b3091e1c3399bd65c272f8623a451163ec5bb61cf50ce150df288ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C28 10980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.