Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbbcc658e10d6495…

MALICIOUS

PDF

76.1 KB Created: 2021-05-18 04:46:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-25
MD5: dce1e90f7912a230c5d2578b60713d6f SHA-1: b2411d4ae6d12830875045b51981fe1fc800a059 SHA-256: fbbcc658e10d64959383dc30c1265a21d001951c3385acf83514d06c51039949
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by ML classifiers and ClamAV, indicating a phishing or trojan payload. It contains an embedded URI pointing to 'nipisod.ru', which is likely a phishing site designed to trick users into downloading further malware or revealing sensitive information. The document body, though heavily obfuscated, contains text related to removing browser extensions, suggesting a pretext for the malicious link.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/strik?utm_term=how+to+remove+chrome+extensions+permanently PDF link annotation
    • http://lurodug.iblogger.org/successful_algorithmic_trading_free.pdfIn PDF document text
    • http://feriwokefawu.22web.org/pdf_to_word_converter_offline_software_filehippo.pdfIn PDF document text
    • http://wixujepigok.22web.org/78032164293.pdfIn PDF document text
    • http://pavuraxef.iblogger.org/world_encyclopedia_free_download.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://s3.amazonaws.com/genukopapovixo/define_straw_man_plan.pdfIn PDF document text
    • https://s3.amazonaws.com/gewisetug/cartagena_protocol_on_biosafety_2000.pdfIn PDF document text
    • https://s3.amazonaws.com/nunakixuma/3035960044.pdfIn PDF document text
    • https://s3.amazonaws.com/savifin/79720379911.pdfIn PDF document text
    • https://s3.amazonaws.com/muwomapotumugi/catia_v6_2017_crack.pdfIn PDF document text
    • http://fodiwivovekuvut.epizy.com/pitogiges.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9d99b939-6ae0-4296-9684-ec1da7582b6f/public_health_administrator_salary_per_hour.pdfIn PDF document text
    • https://s3.amazonaws.com/ragejufa/fidelity_investments_401k_terms_of_withdrawal.pdfIn PDF document text
    • https://s3.amazonaws.com/pavujiniz/46198318154.pdfIn PDF document text
    • https://s3.amazonaws.com/tejuvonixag/pekuta.pdfIn PDF document text
    • https://s3.amazonaws.com/juvetaso/xixuvojupomemevufajidik.pdfIn PDF document text
    • https://s3.amazonaws.com/rudelazifizuvo/bovatupewunevupuse.pdfIn PDF document text
    • http://rumavajusugeg.rf.gd/78263412270.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/11329b14-9948-491f-bb08-fe05c7b9b961/vizio_sb3820-c6_38-inch_2.0_channel_sound_bar_reviews.pdfIn PDF document text
    • https://s3.amazonaws.com/jupevuxirapi/carpooling_website_templates.pdfIn PDF document text
    • https://s3.amazonaws.com/sojuravewi/vutogazumasuliwijivap.pdfIn PDF document text
    • http://suxukapuvajobe.epizy.com/what_is_1-3-1_zone_defense.pdfIn PDF document text
    • https://s3.amazonaws.com/rojalexipokadaz/lutheran_church_canada_salary_guidelines.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000eb44.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEB44 5456 bytes
SHA-256: 928493473e9ccd1b156b032eb6fde5a0e17fdea89a54bdd0d85c77f5b5c9914e
font_01_sfnt_off0000fdc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFDC7 10912 bytes
SHA-256: 2c7d8a6eada5cd6677a15b756bb211e10194fece7524aaa8d0341d8537e25532

Open this report in the interactive analyzer, or submit your own file for analysis.