Malicious PDF — malware analysis report

Static analysis result for SHA-256 daa5e6ad64c2f4b6…

MALICIOUS

PDF

164.3 KB Created: 2021-03-11 06:46:43 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d7de1804786cd9471ccffa98f1c78b9c SHA-1: ea8abedd92dfc7a4775224d75dc6180093c41c1f SHA-256: daa5e6ad64c2f4b6c8ec53d8d130e210a76ed12cc8229b1199c92ad80d7ca226
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged as malicious by a machine learning classifier and ClamAV, specifically as a phishing trojan. It contains an embedded URL pointing to 'soxebez.ru', which is likely part of a phishing campaign. Although no scripts were explicitly extracted, the PDF structure and the presence of an external URI suggest an attempt to redirect the user to a malicious site, likely for credential harvesting or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=cisco+catalyst+3850-+24t-+s+datasheet
    • https://jazafojof.weebly.com/uploads/1/3/4/3/134310209/kuzutazutamati.pdf
    • https://dawanuma.weebly.com/uploads/1/3/4/3/134305997/gunege.pdf
    • https://dujulofenali.weebly.com/uploads/1/3/4/5/134587776/f6de2c7e762.pdf
    • https://winateminapalem.weebly.com/uploads/1/3/4/0/134041456/3566759.pdf
    • http://nadefememidep.medianewsonline.com/24366704642.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • http://xolevusafo.myartsonline.com/rarakawepaxew.pdf
    • https://s3.amazonaws.com/pisik/emglo_master_series_air_compressor_parts.pdf
    • https://s3.amazonaws.com/wazagidonux/b._ed_2018_odisha_admit_card.pdf
    • http://valupakukav.myartsonline.com/que_son_los_principios_de_la_economia_de_movimientos.pdf
    • https://uploads.strikinglycdn.com/files/fb14d3de-f306-4543-9c95-a7c5161920a1/percy_jackson_and_the_titans_curse_watch_online.pdf
    • https://s3.amazonaws.com/wapabefizosumi/adblock_blocker_for_chrome_pc_free.pdf
    • https://6363ce23-9394-4102-a476-7be320345719.filesusr.com/ugd/7c41c1_2872616e5c7f4823864ea04d6c99b5d3.pdf?index=true
    • https://uploads.strikinglycdn.com/files/5ab9613e-0633-4d06-b5ed-27a605091336/52713212935.pdf
    • https://18cb0a1d-3822-48a5-9ca0-56465202bc9b.filesusr.com/ugd/96564c_5c0efb28a257414ba28648f30923360b.pdf?index=true
    • https://b6e49935-6d58-4bde-831f-6e0b746776d3.filesusr.com/ugd/7d321f_4c3ac43eed90434492a47b0a0f88c05b.pdf?index=true
    • https://s3.amazonaws.com/muvarelo/sheet_metal_louver_cutter.pdf
    • https://s3.amazonaws.com/fojaxexino/mujewit.pdf
    • https://uploads.strikinglycdn.com/files/321c5d4f-e489-45aa-8cb7-14cfba8bc45c/zawawaranudusexiso.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://scripts.sil.org/OFL

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off0002407e.bin
4af802bf6e4527a833aa68419e3ca8404aac0ba6dd60e927b68d3de9352af7de		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2407E 29144 bytes
font_00_sfnt_off00020349.bin
fd0b8546939583a4226f32da95d0a597628fe235b136f97ae2a9e8fc1f278c8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x20349 5612 bytes
font_01_sfnt_off00021679.bin
475540cb1341f03a0d333d21dac2c20bdd93df902a2510fc119a58157adb0eb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x21679 12260 bytes
font_03_sfnt_off000274ef.bin
d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378		 pdf-font-stream PDF embedded font (sfnt) at offset 0x274EF 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.