Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2bd51942568291b…

MALICIOUS

PDF

74.6 KB Created: 2021-03-28 22:46:17 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: b630fbcfbccfdcfeb3da68f7accc8e8b SHA-1: 5e4e006a953aa3a75a30fa81357833e9b18b3a0f SHA-256: f2bd51942568291bacd5d7bfd137b8994c15584abff71f50f6db47216051dcde
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URI pointing to 'soxebez.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, suggests a lure related to 'adaptive defense 360 pdf'. No scripts were extracted, but the PDF structure and embedded URI are strong indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://soxebez.ru/award?keyword=adaptive+defense+360+pdf
    • http://fastdonwload.space/53743096651lctjr.pdf
    • http://arboozfilm.com/haughtiness_crossword_answerskpk5.pdf
    • https://gutinevar.weebly.com/uploads/1/3/4/6/134611255/583c28122.pdf
    • http://znatural.space/what_causes_darkened_teethwdqqo.pdf
    • https://jekosupoma.weebly.com/uploads/1/3/1/6/131637113/setelu_kimoxibakeg_waxavo.pdf
    • http://lixodamevurobar.mygamesonline.org/what_are_the_elements_of_psychoanalytic_theory.pdf
    • http://tumbochka.space/406009297595lrgw.pdf
    • https://relowuforobelo.weebly.com/uploads/1/3/4/5/134528439/37ced0.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bujekotu.atwebpages.com/89759486335.pdf
    • http://zuputes.atwebpages.com/how_to_install_fleck_5600_water_softener.pdf
    • http://guzadexogemadev.rf.gd/67558084604.pdf
    • http://ridibob.epizy.com/samples_machine_learning_algorithms.pdf
    • http://kawerulim.onlinewebshop.net/do_plants_need_cool_or_warm_humidifier.pdf
    • https://uploads.strikinglycdn.com/files/da819a1f-cd50-4ff3-b1e8-dca9e813c8b8/how_much_do_district_attorneys_make_in_los_angeles.pdf
    • https://uploads.strikinglycdn.com/files/7781de06-74be-46e7-83eb-6e46be44ec1f/how_much_does_it_cost_to_replace_a_washing_machine_belt.pdf
    • https://s3.amazonaws.com/rijaliwiguvex/95330381431.pdf
    • https://s3.amazonaws.com/fifuto/mallow_weed_herbiguide.pdf
    • https://s3.amazonaws.com/dojivewobasuval/78950140319.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e5be.bin
81cc926e60ef775a4c3ba67e823cb171e7227686f0065c2c5e49d20bdc22e5a4
pdf-font-stream PDF embedded font (sfnt) at offset 0xE5BE 5416 bytes
font_01_sfnt_off0000f843.bin
dce3148fc9d56068bad748b36b2ac6ffcf21d90747b2e2bf4f21471f2f6ee1c1
pdf-font-stream PDF embedded font (sfnt) at offset 0xF843 10820 bytes