Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c9b14e94e5bcd76…

MALICIOUS

PDF

81.6 KB Created: 2021-05-09 04:40:50 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 353e412c9d35419bb7b6db0c8fd5da71 SHA-1: 6971d339adc2139afd5160885ade9169f43bf970 SHA-256: 8c9b14e94e5bcd76d41109d2117bc5c15920024a90e7aa1eaa063e0e8609c926
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a heuristic indicating an external URI, specifically 'https://soxebez.ru/strik?utm_term=what+to+write+in+your+nephew%2527s+1st+birthday+card'. This URL is presented in a context that suggests a phishing or social engineering lure, disguised as information about a birthday card. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=what+to+write+in+your+nephew%2527s+1st+birthday+card
    • https://cdn-cms.f-static.net/uploads/4369318/normal_606e1dec0567f.pdf
    • http://xejitifuwoligaf.mypressonline.com/belajar_program_arduino_uno.pdf
    • http://xukosususif.medianewsonline.com/woduf.pdf
    • http://sibogufurab.medianewsonline.com/busikopi.pdf
    • http://pefiworawodud.mypressonline.com/vitem.pdf
    • http://ribadubeko.scienceontheweb.net/tetiwalevor.pdf
    • https://static.s123-cdn-static.com/uploads/4383464/normal_5ff8c3a5c9d2b.pdf
    • http://befujukipepejem.mygamesonline.org/bixetixajusedosunopunal.pdf
    • http://sisogelodaze.medianewsonline.com/zunoxavibirabek.pdf
    • http://mevesepegubisis.scienceontheweb.net/ingls_bsico_daniel_welsch_gratis.pdf
    • https://static.s123-cdn-static.com/uploads/4406466/normal_5fc743cc1ccf9.pdf
    • https://static.s123-cdn-static.com/uploads/4366400/normal_5fdfd45d481e6.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/wukevirenesu/36028380349.pdf
    • https://s3.amazonaws.com/dinilederu/80984373884.pdf
    • http://jowawaba.atwebpages.com/html_css_table_templates_free_download.pdf
    • https://uploads.strikinglycdn.com/files/d6707fa4-94f4-45a4-91a5-34323ca39b5e/who_makes_the_best_quality_electric_fireplaces.pdf
    • https://s3.amazonaws.com/salade/2386762560.pdf
    • https://s3.amazonaws.com/rezugekolaba/wuzuzerizut.pdf
    • http://molujafit.atwebpages.com/operational_risk_definition.pdf
    • https://uploads.strikinglycdn.com/files/a1d85812-fc17-42fc-a24b-3a86185fb7f6/65758825389.pdf
    • https://uploads.strikinglycdn.com/files/678986f4-c984-4238-9364-22983f602fc6/planet_bike_proteg_9.0_computer.pdf
    • https://s3.amazonaws.com/vunizi/gigabyte_geforce_gtx_970_specs.pdf
    • https://s3.amazonaws.com/lukepepe/bcbs_of_minnesota_provider_demographic_change_form.pdf
    • https://s3.amazonaws.com/sajatesawodiji/davepenexefufetukameme.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ff93.bin
3a8e343c9e95fa332253c18d082091c30f83b838a72bcd15abe0cf8d5210a742		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF93 5564 bytes
font_01_sfnt_off00011298.bin
9e66571872421c418a4e0e51532d0f8653a568014ae46da89e918e6526542620		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11298 11236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.