PDF malware analysis — malicious · 0f7b06867a7865f7

MALICIOUS

PDF

74.2 KB Created: 2021-03-12 06:22:55 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 7ecbfcaec1b9f09ffa99b0a9e266489d SHA-1: aee989d7e8c8e9809299dc3af66944593d26a9fc SHA-256: 0f7b06867a7865f7dff9d99df4d58f0925dd3ffa1dc55f731b46c6bbdf8f7f0e

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was detected as malicious by ML classifiers and ClamAV, indicating a phishing attempt. The document body, though heavily obfuscated, contains text related to a 'First aid guide for choking', which is likely a lure to encourage users to click on the embedded malicious URL. The primary malicious URL identified is https://kuzutuzo.ru/123?utm_term=first+aid+guide+for+choking.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://kuzutuzo.ru/123?utm_term=first+aid+guide+for+choking
- http://maxirem.mygamesonline.org/how_to_clean_dymo_sensor.pdf
- http://kekijojovif.sportsontheweb.net/satuzajeneretud.pdf
- http://palawawez.mypressonline.com/lugagagizevelutej.pdf
- http://buzifun.22web.org/brts_road_vijayawada_full_form.pdf
- http://lomuwugevona.getenjoyment.net/jozikuguwoxexebirez.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://tagitefidunun.epizy.com/what_is_the_reset_button_on_canon_printer.pdf
- https://17a6c5a8-0587-4adf-8126-5b439e15a62f.filesusr.com/ugd/54bec1_bfa462d1e0f74217bd121944f21dc66f.pdf?index=true
- https://50bf384a-eeac-4f26-a262-e2ba1a5e00ba.filesusr.com/ugd/17159d_a433e4ec3d4542fca223519bec41e682.pdf?index=true
- http://vetovolixexa.epizy.com/lofodagovipeguvikemejadup.pdf
- http://mowumurukilada.rf.gd/woxokijepubusil.pdf
- https://6a24fdd2-d4a5-4c4b-882b-0f3115751bcf.filesusr.com/ugd/04e6f9_30af8a59bdeb4e798e4afb078448cd18.pdf?index=true
- http://bowukedogatowo.epizy.com/what_is_the_meaning_of_555_in_the_bible.pdf
- http://mupeluzapuwefa.rf.gd/sononejimademareko.pdf
- http://merekum.rf.gd/clinical_social_work_exam_study_guide.pdf
- https://b7f5b04e-b247-49a4-9dc0-39f0c843ec09.filesusr.com/ugd/b56f86_b56d0a8d473044209f4c88fc2a4f79ef.pdf?index=true
- https://27a83426-c768-4525-a63d-b5b732cca755.filesusr.com/ugd/28b3f7_3ed77cb218dc46ec91b5eecd3fd6a99c.pdf?index=true
- http://jemukiguwuw.myartsonline.com/1258275896.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e71f.bin` `25a430cbf26aedbecc786d1f26e478d4b832bbeae70efe78f83dcc64a0fcbb62`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE71F	5268 bytes
`font_01_sfnt_off0000f90d.bin` `a7bc1746a75762c2b517adadcba4500d7f0f8f8563f07a58753a60a8d76d5241`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF90D	10304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.