Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad4ba754a73fde14…

MALICIOUS

PDF

82.5 KB Created: 2021-03-13 19:46:45 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 32b00ee65768adc367d7b8873d874649 SHA-1: 59213ab090b5a6e37000c8177bc52718394765c5 SHA-256: ad4ba754a73fde1471d1729a5f9d1abf556d3ceb140a7f9e376dfa01646a9086
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by a machine learning classifier and ClamAV as malicious, with a high risk score. It contains an embedded URI pointing to a suspicious domain, 'soxebez.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a riddle or quiz format, a common lure for phishing. No scripts were extracted, but the presence of external URLs and the ML/AV detections strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=what+words+start+with+g+and+end+with+e
    • http://dwatches.site/69169184987nlyhb.pdf
    • https://cdn.sqhk.co/bisuligiga/tggjfib/waguposunexe.pdf
    • https://cdn.sqhk.co/jovakuki/0qhhjgt/43810677389.pdf
    • http://whowill.ru/86907069300zgliz.pdf
    • http://digitaltoolsfor.xyz/995041212048plhr.pdf
    • https://cdn.sqhk.co/vibisidumes/Lid8jcG/townsmen_6_1._2._4_mod_apk_download.pdf
    • https://cdn.sqhk.co/kulobibab/hj9Ngex/dwight_schrute_gif_thank_you.pdf
    • http://osummer.space/38140230042cksj9.pdf
    • https://cdn.sqhk.co/tevunufoba/hcelAZ2/wefodokutivupam.pdf
    • https://cdn.sqhk.co/junibukison/egeggiN/canalyzer_demo_version.pdf
    • https://cdn.sqhk.co/kimorotadopo/RBqq9ji/22617569370.pdf
    • https://cdn.sqhk.co/gumoxixo/9gcicih/lalewawabunuv.pdf
    • https://cdn.sqhk.co/bufudoraxala/bZjhUjb/larva_heroes_battle_league_mod_apk_android_1.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/15da7f32-a474-419b-a787-075e15636067/mavivedafigetujig.pdf
    • https://s3.amazonaws.com/farezelof/roxasaruvorogujak.pdf
    • https://uploads.strikinglycdn.com/files/0648f11a-beb5-48d6-8f83-c0925f6350ac/troy_bilt_xp_3000_psi_pressure_washer_oil_change.pdf
    • https://s3.amazonaws.com/gomaxod/21513180372.pdf
    • https://uploads.strikinglycdn.com/files/dd35f5a1-f1a4-4a05-b0b5-65b300765143/vinotizabava.pdf
    • https://uploads.strikinglycdn.com/files/cf6a3c27-a299-4d86-86b0-a35e4009823c/a_christmas_carol_movies_1984.pdf
    • https://uploads.strikinglycdn.com/files/1cbac677-debf-4dbe-be80-b88c68209374/how_to_start_a_conclusion_for_a_lab_report.pdf
    • https://uploads.strikinglycdn.com/files/7b5aa23a-2f19-4f81-8971-7b19c4d12a1e/vudimuzozaxejagok.pdf
    • https://uploads.strikinglycdn.com/files/b0b29c5a-8911-4f1f-bfb9-bc50f8ac1df3/arbol_genealogico_de_abraham_en_espaol.pdf
    • https://uploads.strikinglycdn.com/files/091d6e48-02e7-4ca1-a8d8-7130ba09a3a9/sonic_fries_nutrition_information.pdf
    • https://s3.amazonaws.com/degagaziv/galawazusilafegodofor.pdf
    • https://s3.amazonaws.com/benubapopikaj/76088681545.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010383.bin
037019b2c23392202b4ea365f4dc6d0329b11ca51126e385dc0d0a923ed01f9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10383 5160 bytes
font_01_sfnt_off0001151e.bin
c6aa7a2d1c5ffb2fb20e1a6a605d4bb3406f9930056f80a90e12043b362e33b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1151E 11476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.