Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9da772a6ac27d45…

MALICIOUS

PDF

77.6 KB Created: 2021-05-23 01:41:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-23
MD5: a790426eab4d2d11c3bd82804f107a3a SHA-1: cfe745fb56451b39ee858c160b77cc5ab0c6f9a6 SHA-256: e9da772a6ac27d4553981679ee8c673ce0f1fd44501daec2d5173df6e180ec46
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is a PDF document identified as malicious by ClamAV and an ML classifier. It contains an embedded URI pointing to 'soxebez.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, suggests a lure related to Discord video sharing, a common tactic for social engineering.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/strik?utm_term=how+to+send+bigger+videos+on+discord PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4414495/normal_6062482479b3e.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4401519/normal_6007a07399505.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4374853/normal_5fcbc0c4d2cb2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4388432/normal_60519e5ad64fd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4453747/normal_5ffe261d36d8c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365646/normal_60618e0fcf205.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/pafexegud/35049829432.pdfIn PDF document text
    • https://s3.amazonaws.com/jafujasiwetid/que_funcion_tienen_los_medios_de_comunicacion_en_las_relaciones_interpersonales.pdfIn PDF document text
    • https://s3.amazonaws.com/bededuxotulapil/decimal_places_worksheet.pdfIn PDF document text
    • https://s3.amazonaws.com/jasipefulaxiduj/how_many_sheets_in_a_workbook_vba.pdfIn PDF document text
    • https://s3.amazonaws.com/kukupunopedon/the_rules_of_basketball.pdfIn PDF document text
    • https://s3.amazonaws.com/gapuruxumeg/pokemon_go_lure_evolution_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/votawawo/what_can_i_do_with_a_business_management_and_marketing_degree.pdfIn PDF document text
    • https://s3.amazonaws.com/wujixus/7118784863.pdfIn PDF document text
    • https://s3.amazonaws.com/vuzotisenixava/lg_hbs-750_how_to_pair.pdfIn PDF document text
    • https://s3.amazonaws.com/xirixepo/information_technology_classification_standard.pdfIn PDF document text
    • https://s3.amazonaws.com/seriposuj/1970_massey_ferguson_165_weight.pdfIn PDF document text
    • https://s3.amazonaws.com/xukanomarexumu/vupodavasamoti.pdfIn PDF document text
    • https://s3.amazonaws.com/divikufifir/45041971226.pdfIn PDF document text
    • https://s3.amazonaws.com/solonebosop/amiri_build_guide.pdfIn PDF document text
    • https://s3.amazonaws.com/povodijirig/83987412084.pdfIn PDF document text
    • https://s3.amazonaws.com/tiniruru/dizokodikajifisovukamuzip.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f019.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF019 5120 bytes
SHA-256: 1f9e1356f5dd670cde8dc9ac8d86add0acecf3ab6b4b6d41d93aa339af58b9c1
font_01_sfnt_off000101ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x101AB 11428 bytes
SHA-256: fefb4c2e0fb7297e085c5d732049af436529a8e3a75691f26d92086b4fc8906d

Open this report in the interactive analyzer, or submit your own file for analysis.