Malicious PDF — malware analysis report

Static analysis result for SHA-256 961aae3691645563…

MALICIOUS

PDF

74.3 KB Created: 2021-03-08 16:26:16 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1e39985f6c67ee2d75e50a86cc887aba SHA-1: da86a6e2a2c3e8b47fb083588bd58e99d19aed20 SHA-256: 961aae36916455635f28bcf3485d8a5db1869224609d0b5cc60bd55f20a9f560
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. An external URI pointing to 'soxebez.ru' was extracted, suggesting a phishing or malware distribution attempt. The presence of embedded PDF objects and the wkhtmltopdf authoring application further support the analysis of a potentially crafted malicious document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=crazy+zombie+9.+0+swf
    • http://megatorg.ru/35243164892h84a.pdf
    • http://clientbluebadge.com/ruxumijukamigbxtd.pdf
    • http://helpcenterbusiness.xyz/doxelavizifutifibamaeqvpz.pdf
    • http://vwwv-avito.online/how_to_pair_motorola_bluetooth_h700afriz.pdf
    • http://fumigatoff.online/automatic_differentiation_techniques_and_applicationsij5px.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/baxunaf/sqlite_data_types_date_android.pdf
    • https://uploads.strikinglycdn.com/files/9a57e235-d3bb-4bb8-870a-a04f2f53c7b1/nuxotulurutopemena.pdf
    • https://1cdd1dcb-54a5-4750-95ad-c4cce9a68cd1.filesusr.com/ugd/1e32c2_38b51ae8ce4a42e1a29daa48a48e46f8.pdf?index=true
    • https://s3.amazonaws.com/sedowedi/kixoxixutituker.pdf
    • https://1923692e-f727-4f58-80a8-3583160180e3.filesusr.com/ugd/c4ccc4_ea95b3817b98487ba7e0344c173db8c9.pdf?index=true
    • https://s3.amazonaws.com/towakog/trento_bondone_hillclimb_assetto_corsa.pdf
    • https://12f7643e-9106-4823-89c2-0bdaecd1bc22.filesusr.com/ugd/1f6d71_4502b057f2224f4cb71d1d24579947fb.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5334422b-dfa1-419a-84e2-fd3f481efb58/bayliner_owners_club_classifieds.pdf
    • https://c931c956-7f53-4e4e-96dc-27d7f003ba63.filesusr.com/ugd/b80c10_717c634c7d134962bdccd3b09f4bb9f5.pdf?index=true
    • https://uploads.strikinglycdn.com/files/bb28bba2-37e3-40fe-8a4c-81ed733debf5/what_does_a_and_b_stand_for_in_van_der_waals.pdf
    • https://uploads.strikinglycdn.com/files/39b01fea-26dc-43dc-8fa8-2b61c8661e83/74581870649.pdf
    • https://uploads.strikinglycdn.com/files/1b71bc61-5981-4ed4-a885-26a1da6906cf/how_to_tell_between_a_viral_and_bacterial_sinus_infection.pdf
    • https://06ebba1c-c738-45d4-b58d-83edbdcc9420.filesusr.com/ugd/b14caa_22ea757ee60f4df793dd7e3db18c61ca.pdf?index=true
    • https://s3.amazonaws.com/xubifupi/limited_company_partnership_agreement_template_uk.pdf
    • https://uploads.strikinglycdn.com/files/5866ae3c-880d-4e87-a893-66edf9b531d5/how_to_calculate_drug_half_life.pdf
    • https://b304dada-1952-41b2-af44-d16a3232bb3f.filesusr.com/ugd/c19c34_c07b659cc85641e5aa0cad0e8dfe1382.pdf?index=true
    • https://855e1e5b-0daf-4dce-aa73-dfad2bfec5df.filesusr.com/ugd/ced2dc_ae0fdebe9d904238b788190bf26e201d.pdf?index=true
    • https://s3.amazonaws.com/fadedosi/all_coming_back_to_me_karaoke.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e18e.bin
2c4746132d61aab1bc680e89d80a95eab96d51ecd47697617f7cf7abf8661aff		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE18E 5500 bytes
font_01_sfnt_off0000f449.bin
8eaaea4c9f384a1be56fcf86cca8369c81fdf131bab8a436314ad70fcab53d89		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF449 11680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.