Malicious PDF — malware analysis report

Static analysis result for SHA-256 9936614049461321…

MALICIOUS

PDF

74.4 KB Created: 2021-03-23 02:24:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: fca503d1b7b89f902b80ad3b54a0e09c SHA-1: d29544783efe59561f4d1c147bcdc15498e60d46 SHA-256: 9936614049461321f5367b9a6ac8e666965f2248c58d35dee76526fb3a5f40e3
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'soxebez.ru', which is likely part of a phishing lure to trick users into downloading further malicious content. The document body, though heavily obfuscated, contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDF documents from web content, further supporting a lure-based attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=scientific+american+presenting+psychology+pdf+free+download
    • http://znasila.ru/rovewerumewijalojagipebepzikqy.pdf
    • http://bonboxstudio.com/zonadosufugunimazh7p6.pdf
    • http://zafamironal.22web.org/mercruiser_4.3_carburetor.pdf
    • http://dsv-trening.ru/coordinate_geometry_formulatsmow.pdf
    • https://cdn.sqhk.co/xufojidaju/ggfjigj/vuvijebopoziza.pdf
    • https://cdn.sqhk.co/zokelofid/AhhSC5j/small_pin_bowling_near_me.pdf
    • https://cdn.sqhk.co/zepipawetopi/edjaMib/zubale.pdf
    • https://cdn.sqhk.co/nutakurij/Ojbdjfl/walking_dead_game_characters_names.pdf
    • http://gooddevice-online.com/26502099776538ka.pdf
    • http://wegolurubakisud.22web.org/aaja_mahi_song_mr_jatt.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/lepefi/what_is_the_renegade_song_from_tiktok.pdf
    • https://a3de454e-1598-42bb-a259-4eb69c42f179.filesusr.com/ugd/fb5067_df18ea65a9034cb8b60a3defbbb9addf.pdf?index=true
    • https://ac911ccd-a574-46a9-bbb3-57bb927ff796.filesusr.com/ugd/2735c9_8596cd11f56f465e9f8ec06279d61a88.pdf?index=true
    • http://fuzulaj.rf.gd/customs_declaration_form_philippines.pdf
    • https://s3.amazonaws.com/jinabisura/sidemen_book_free.pdf
    • https://s3.amazonaws.com/fowikorejodi/vixujodekagowul.pdf
    • https://6d706a39-1f93-4f1a-9423-caccf7e65e71.filesusr.com/ugd/69f91f_99863798357c4bd6bf3c24c994400518.pdf?index=true
    • https://uploads.strikinglycdn.com/files/c78d9df4-5544-4aff-9cf7-bc3a149417bc/how_to_draw_anime_girl_tutorial.pdf
    • https://uploads.strikinglycdn.com/files/b517ddee-5163-435d-bde4-e04ab5c7806c/la_amortajada_resumen_personajes.pdf
    • http://bubewap.rf.gd/4400938540.pdf
    • http://vowonedof.epizy.com/guia_ceneval_contaduria.pdf
    • https://uploads.strikinglycdn.com/files/4045c03a-0c41-4a03-a16f-b287e875af85/luxawofob.pdf
    • https://s3.amazonaws.com/varolexexus/67015463303.pdf
    • https://s3.amazonaws.com/buganabowumujef/2011_challenger_srt8_performance_upgrades.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e216.bin
73c44d870cba392b3992abc471c984764322eab488e9e0612f92dce4da4b087e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE216 5864 bytes
font_01_sfnt_off0000f5fa.bin
cf4bc823edd3806f37540ffbaf66800653920ab20d5c91ffca83064acc665372		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF5FA 11584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.