Malicious PDF — malware analysis report

Static analysis result for SHA-256 df3de6d35764aed6…

MALICIOUS

PDF

73.2 KB Created: 2021-03-29 10:41:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cce9df4b5e2a16e01cf8d0a442219851 SHA-1: 74c7602811ac77c6dd71e567a61cb93a7c29a684 SHA-256: df3de6d35764aed64bfb476b11a80c77ac161699ecfad0437676ab110bf686ef
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ClamAV and an ML classifier, with a high risk score. It contains an embedded URI pointing to 'https://soxebez.ru/123?utm_term=ascending+descending+numbers+free+worksheets', which is likely a phishing or malware distribution lure. The document body, though heavily obfuscated, suggests a theme of 'Ascending descending numbers free worksheets', aligning with a common social engineering tactic to entice users to click malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/123?utm_term=ascending+descending+numbers+free+worksheets
    • http://kujuwuwoseg.iblogger.org/little_fires_everywhere_summary_spoiler.pdf
    • http://faxagigotitij.66ghz.com/hymenolepis_diminuta_life_cycle.pdf
    • http://shoes-storie.club/worksheet_on_writing_decimals_in_word_formvrp60.pdf
    • https://cdn.sqhk.co/vimerokil/VIgfxKG/access_my_samsung_notes_online.pdf
    • http://perinolaguzur.iblogger.org/29411535056.pdf
    • https://cdn.sqhk.co/bapisolel/jaWgcib/77775001486.pdf
    • http://jushq.pro/dell_monitor_2001fp_manualpgpzn.pdf
    • http://vinograd.io/loxazatawus5h4f.pdf
    • https://cdn.sqhk.co/pivokazi/jfgdWM6/zavetivovudugonixe.pdf
    • http://xazutakivad.iblogger.org/breath_of_the_wild_official_guide.pdf
    • http://topcreditmonitoring.info/neded3ib0m.pdf
    • http://xrootunited.com/menomupuko1vo8r.pdf
    • http://ruwakus.22web.org/86795933314.pdf
    • https://cdn.sqhk.co/rokogikapo/Phakggd/dalen.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://gupomikalusa.rf.gd/zufelabevi.pdf
    • http://ronaripijamalon.epizy.com/how_to_aim_with_crossbow_dark_souls_pc.pdf
    • http://mewuxugeje.epizy.com/demonstrative_pronouns_exercises_advanced.pdf
    • http://dotaxamis.epizy.com/how_much_does_a_small_refrigerator_cost.pdf
    • https://2489a575-72f7-492f-b117-28cfe4a4d2a3.filesusr.com/ugd/d81705_e39bd7f811e24d47bd325443ba50e047.pdf?index=true
    • http://gowamatul.epizy.com/the_blind_side_netflix.pdf
    • http://bapejilujuzegu.rf.gd/lilowetimitirupemefadaw.pdf
    • https://6b54b0b2-91db-43cc-88c8-bbc4f7e20b37.filesusr.com/ugd/a773aa_9309bc6f00ef4eb59ab6291f43c1225a.pdf?index=true
    • http://tuzotulerijenej.rf.gd/pitanofapemotisimo.pdf
    • https://305aa2e3-e1d2-413d-aa2e-f1bb83d03ded.filesusr.com/ugd/92ee2b_25fb359ac5de4a4da7d9b2f37d85576a.pdf?index=true
    • https://e082cb0d-9c22-4a21-acb7-e2c6127a51d3.filesusr.com/ugd/ff0c06_4db4eec7d21645b4b20e94937acf2114.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e073.bin
d097386a473733ea450fba03e124f915ff7b87e25701a575e208621ba7dd46b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE073 5476 bytes
font_01_sfnt_off0000f300.bin
45b63305c98ea74398575bdd674971a72c726c4f3f74a8123c683fff06a6b43e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF300 10568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.