PDF malware analysis — malicious · c606e7faf6ab9a54

MALICIOUS

PDF

82.1 KB Created: 2021-03-13 19:19:44 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 853ccb5e1a4bafba9131babe8ce81b79 SHA-1: 1c86239df6be571c5899870989ef487a95a62681 SHA-256: c606e7faf6ab9a543a911075902174affa2615aae2da13d125e6514e1d2c030d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, specifically flagged as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'soxebez.ru', which is likely part of a phishing or malware distribution scheme. The document body, though heavily obfuscated, suggests a lure related to 'worksheet answers', aligning with a phishing pretext.

Machine Learning

Nyx PDF Classifier malicious score 0.9995

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://soxebez.ru/wix?keyword=beowulf%252Fgrendel+worksheet+answers
- http://guworumitikizu.iblogger.org/java_jre_64_bits_windows_8.pdf
- http://idealicaitalia-official.site/what_time_does_lol_patch_come_outyg8vt.pdf
- http://helpforteam.com/badlands_national_park_fun_factsky04b.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- https://36425c1f-c329-48aa-845d-1f8252cb45c8.filesusr.com/ugd/01d500_d1c2f2a2f2394097a5f2b91d2f3e847d.pdf?index=true
- https://59b7e61f-9850-45ee-add2-e9646db267e4.filesusr.com/ugd/5b9365_b3fa6b74a203459db2e8a6ff16c45f92.pdf?index=true
- https://uploads.strikinglycdn.com/files/8b807d17-e3d2-46d9-9399-26a015f3d59a/marvel_movies_and_tv_shows_in_chronological_order_2020.pdf
- https://s3.amazonaws.com/jizubisetebof/access_consciousness_books.pdf
- https://uploads.strikinglycdn.com/files/24205ee1-9ae4-42cb-862e-537ae891e4ef/tasegi.pdf
- https://s3.amazonaws.com/fisulefajow/92876218940.pdf
- http://xamelolupete.epizy.com/8014169171.pdf
- https://s3.amazonaws.com/lixuduwonifa/martin_luther_king_jr_famous_speech_youtube.pdf
- http://zapofekeba.rf.gd/5879240358.pdf
- https://uploads.strikinglycdn.com/files/e11b9ec4-791c-4670-9819-3aac8fdf01ba/asus_laptop_q550lf_drivers.pdf
- https://s3.amazonaws.com/tixedujegibex/english_to_bengali_dictionary_free.pdf
- https://s3.amazonaws.com/bojafazes/vafelakozozixud.pdf
- http://wodasakuzetu.rf.gd/46407796481.pdf
- http://segegilomojok.epizy.com/japalajezudegoweg.pdf
- http://gegawuwiru.epizy.com/57103259364.pdf
- https://uploads.strikinglycdn.com/files/238b6a0f-f7fe-47af-ab23-1c8addb577b5/war_of_the_worlds_book_and_movie_comparison.pdf
- http://datidogebe.epizy.com/35469491103.pdf
- https://uploads.strikinglycdn.com/files/8abeedb3-e9e9-468f-8328-5c4736a8cbc3/vicks_cool_air_humidifier_instructions.pdf
- http://wuwopeluba.epizy.com/nirepigoketemipugogilon.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000f6f0.bin` `17eb81b2cfefcff78345593118b00d0e17fb7efc05f8f03146dd5ea92932ce05`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF6F0	5244 bytes
`font_01_sfnt_off000108df.bin` `6308f574ed9a3646888130ce4e8638ebaced76694ad4345af7030554438f359a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x108DF	10620 bytes
`font_02_sfnt_off00012cf0.bin` `0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12CF0	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.