PDF malware analysis — malicious · bbc293871fc62754

MALICIOUS

PDF

78.8 KB Created: 2021-03-12 06:47:46 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 684bfa79fdc08b2657ef52d256c76045 SHA-1: 751de690a46565b7de4ad69a550c87fc40e2d858 SHA-256: bbc293871fc62754311aec103f8df50fd029c15c5990f2752035fd09c75dcf4f

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to 'xezojetit.ru', which is likely the primary distribution point for a malicious payload. The document body, though heavily obfuscated, contains text related to a birthday greeting, suggesting a social engineering lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://xezojetit.ru/123?utm_term=happy+birthday+ashu+name+video+song
- https://cdn.sqhk.co/linaxezo/iggfRZe/scratch_pong_tutorial.pdf
- https://cdn.sqhk.co/jiluputumusi/9iihWhd/best_gem_mining_in_western_north_carolina.pdf
- https://cdn.sqhk.co/novozefox/HGjdgjZ/47929963829.pdf
- http://warajuvevuv.medianewsonline.com/zakokitagexusazuzinar.pdf
- https://cdn.sqhk.co/xeribaba/cv57usZ/60465625301.pdf
- http://relibafogat.sportsontheweb.net/42499193576.pdf
- https://cdn.sqhk.co/zikufivol/ggVlYYv/bloons_tower_defense_3_rapid_typing.pdf
- http://noxugimeto.iblogger.org/death_note_manga_sequel_release_date.pdf
- https://cdn.sqhk.co/kupujape/iieIOMz/iptv_android_tv_4pda.pdf
- http://nogefiri.iblogger.org/vuwigojuziselero.pdf
- https://cdn.sqhk.co/jogeguzotire/ehfa6oC/deep_sea_creatures_list.pdf
- https://cdn.sqhk.co/kobadaxo/ejiCPI7/47072064357.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.daltonmaag.com/
- http://pakifisaxere.epizy.com/what_do_you_say_to_someone_who_is_stressed_about_school.pdf
- http://roporuti.onlinewebshop.net/financial_accounting_mcqs_with_answers.pdf
- http://zimaroted.rf.gd/zotet.pdf
- http://kepinud.rf.gd/sujejelebukokowan.pdf
- http://dunizolosonon.rf.gd/businessman_2_full_movie_hd.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000e957.bin` `d4f0fdf630c0dfedbdfac4b60961658c62a8e7aa1ebc03379a1879d7d0ca071f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE957	5488 bytes
`font_01_sfnt_off0000fbcf.bin` `08c2490dfad338acf20b91ae71dc5aa3616d13b188dcf7cd7ebd6e65d27e1b93`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xFBCF	10672 bytes
`font_02_sfnt_off00011fd7.bin` `0d0f64e27578eb124b8bc81c7eceacdd166e22eddd95c81328e9fbd7de2a6333`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11FD7	4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.