Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2014d2352afe19e…

MALICIOUS

PDF

115.8 KB Created: 2021-04-01 16:31:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 931f0c9eaea5c76712a1be179ef17c67 SHA-1: 431e95fa4adf301803d8babb02135bff563a408d SHA-256: f2014d2352afe19e5e39e1b9f3a2e354aa5f2fdd8d764e6e57cbcc4663b46702
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by a machine learning classifier and ClamAV, indicating a high probability of malicious intent. The embedded URL, https://soxebez.ru/wix?keyword=sturdy+vat+material+ffxiv, is a primary indicator of a phishing or malware distribution attempt. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/wix?keyword=sturdy+vat+material+ffxiv
    • https://cdn-cms.f-static.net/uploads/4409621/normal_602d440e59a6f.pdf
    • https://static.s123-cdn-static.com/uploads/4366311/normal_5fe3aa3aa0955.pdf
    • https://wazufepema.weebly.com/uploads/1/3/5/3/135383665/bibonodoxewalo_zaxiluwuwupile.pdf
    • https://lowixuwegula.weebly.com/uploads/1/3/0/7/130775587/zawetivugafuf_berira_nuvuves_kurob.pdf
    • http://changepass.online/ukulele_strumming_patterns_4_4d4fg6.pdf
    • http://lidlid.xyz/how_to_calculate_gas_constant_rjyf0r.pdf
    • http://mybiol.site/weider_ultimate_body_works_workout_chartiy5am.pdf
    • https://xitupiwe.weebly.com/uploads/1/3/4/4/134489196/1573320.pdf
    • https://kakenemewaxe.weebly.com/uploads/1/3/4/6/134655752/3f1e321.pdf
    • https://cdn-cms.f-static.net/uploads/4392441/normal_60315a57074b0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://damabop.epizy.com/building_vocabulary_chemical_bonds_and_reactions_answers.pdf
    • https://s3.amazonaws.com/buponuwebi/wudatoza.pdf
    • https://s3.amazonaws.com/zuponefi/suzisifegerasubukuziwul.pdf
    • https://uploads.strikinglycdn.com/files/3b864643-17a9-4795-a10c-5ec6cd0fb0ba/61834741485.pdf
    • https://uploads.strikinglycdn.com/files/112ea4e0-7eec-45b8-b04b-6625bd6c2512/gigabokakaruw.pdf
    • https://s3.amazonaws.com/didowugorokirug/button_color_android_xml.pdf
    • https://uploads.strikinglycdn.com/files/b509cbb6-5663-4b73-8112-acc8249ddf98/33858911022.pdf
    • http://wefasinufatotag.epizy.com/kilabeji.pdf
    • https://uploads.strikinglycdn.com/files/79e9b538-61e0-405a-9d86-764f1853ed85/gadaxozegu.pdf
    • http://nesuzilusuk.epizy.com/jeppesen_airway_manual_general.pdf
    • https://s3.amazonaws.com/jinotugiwomo/todoma.pdf
    • https://uploads.strikinglycdn.com/files/b9dc145e-fb8f-4bfc-a00d-c6f4967704f3/24667019594.pdf
    • http://rizeluma.epizy.com/list_of_bible_stories_from_genesis_to_revelation.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00012c1c.bin
a563c2f5840334b8de8aff88251ca5042c277db8e7529a77f089a7eae6f4f673		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C1C 20152 bytes
font_01_sfnt_off00016cbe.bin
c5a3557ebe523d93b1a2c0f0da16e1be519e44f9981c436c8ed4887309d22e0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CBE 5208 bytes
font_02_sfnt_off00017e70.bin
c5238c385377f37bc253543bd355170da3efb31190ef1966fb088c0e15c6b433		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17E70 12840 bytes
font_03_sfnt_off0001a9b8.bin
0de0daea690cd97bd5402afaaacb445fac3aa770f186c09a87af6b1560f4348e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A9B8 16220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.