Malicious PDF — malware analysis report

Static analysis result for SHA-256 32b77cd2bce77fdc…

MALICIOUS

PDF

69.7 KB Created: 2021-05-21 02:12:29 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-02
MD5: bd4935eb4cadb6530811e91bf49903e6 SHA-1: c362f20605e2b2052a29609531d899bf3f314f04 SHA-256: 32b77cd2bce77fdcca8b2b2cb9143eb61cb73c89f46027773ed979b5fba16908
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by ML classifiers and ClamAV, with a high risk score. It contains an embedded URL pointing to 'nipisod.ru', which is likely used to deliver a secondary payload or conduct phishing. The document body, though heavily obfuscated, appears to reference a technical book title, suggesting a lure to entice users to click the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=operating+system+concepts+silberschatz+7th+edition+pdf+free+download PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4372074/normal_5fde48fa83874.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4381759/normal_5fcce88ccc7e5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4368781/normal_6022c4b15d3b5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4422628/normal_60480a9f53c6f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4365639/normal_601b74c60138f.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4451556/normal_603550f7cdcbc.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485436/normal_60618aa195c8d.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4489441/normal_6012bfd627ddd.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4464522/normal_60054045bf7b1.pdfIn PDF document text
    • https://static.s123-cdn-static.com/uploads/4367640/normal_5ff0cecd5d751.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4485569/normal_602dc68b82513.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa9e9ece-5128-4dcd-a540-0ea118d51e1e/are_the_harry_potter_books_free_on_kindle.pdfIn PDF document text
    • https://s3.amazonaws.com/perurulexi/89567376124.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/735af04c-23f5-4336-9cc0-822d92c2e223/fejaxuxabivesobi.pdfIn PDF document text
    • https://s3.amazonaws.com/fomudebipefasu/jenavavo.pdfIn PDF document text
    • https://s3.amazonaws.com/fapaga/35453645973.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ab0e6dc8-2db9-4a0d-8fcc-970fc723b771/how_to_replace_roomba_battery.pdfIn PDF document text
    • https://s3.amazonaws.com/xumakomowi/how_to_edit_text_on_a_scanned_picture.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/aa1408c9-1126-405f-8b44-4aad4f21581e/54123975208.pdfIn PDF document text
    • https://s3.amazonaws.com/marimejerebo/zenimidekeduliraga.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8de87c01-6fac-4f34-a427-19ee4d93ddb9/irregular_verbs_list_with_tamil_meaning_free_download.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d15f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD15F 6060 bytes
SHA-256: 3cf2ee53d9b49af4b586707a06903b6322a380882fd8fee8cbd11b4ed18e6b21
font_01_sfnt_off0000e5f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE5F1 10036 bytes
SHA-256: a4d51ac1bf13343c5baf2cdec981b721a89ed0d731bbffa9d49ac6c69c7c5c5d

Open this report in the interactive analyzer, or submit your own file for analysis.