Malicious PDF — malware analysis report

Static analysis result for SHA-256 38f84a213a3191f6…

MALICIOUS

PDF

76.9 KB Created: 2021-03-12 17:45:14 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 2ae1059107af002e613859dcfbe4819d SHA-1: 15ece309d77d254b72c116a6a32aa35963c2b974 SHA-256: 38f84a213a3191f6ca40d474e489e4ad5d339a30321455c6bf107895e6571e34
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, specifically as a phishing trojan. It contains an embedded URI pointing to a suspicious domain, 'druttle.ru', which is presented as a search result for an essay. This suggests a phishing or malware distribution attempt, likely using the document as a lure to direct users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=anti+apartheid+movement+essay+pdf
    • http://gajonedorebuko.mywebcommunity.org/phonics_book_for_first_grade.pdf
    • http://laluwaraselolar.mywebcommunity.org/dafakituvijepagilifazer.pdf
    • http://meetsalle.xyz/17632767228xzdgg.pdf
    • http://tuderoba.getenjoyment.net/what_does_physical_stamina_mean.pdf
    • http://rupaduwovuw.getenjoyment.net/engineering_drawing_orthographic_projection_examples.pdf
    • http://lenudes.com/robot_vs_zombies_game_unlimited_money8qx62.pdf
    • http://pakawuwujawo.getenjoyment.net/moriju.pdf
    • http://generatorsale.ru/where_is_the_idle_control_valve_locateda4b8w.pdf
    • http://pegejoruvufiron.sportsontheweb.net/developmentally_appropriate_curriculum_best_practices_in_early_childhood_education.pdf
    • http://cosmeteca.com/givumunadopebifelimuwudy3ej2.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://s3.amazonaws.com/leributafa/datasheet_5551_transistor.pdf
    • https://d03ec42c-8b93-48d3-a61e-9aee396c0db4.filesusr.com/ugd/1e557c_45ca13dd1bfc4869b11216615395d6be.pdf?index=true
    • https://73e25548-3913-4bbb-aa69-a1b25f69568d.filesusr.com/ugd/cece23_3e6277d1479a4caa8fa8a7fff5d8a688.pdf?index=true
    • https://s3.amazonaws.com/zaxawetawupo/how_to_make_dingy_sheets_white_again.pdf
    • https://5a995288-ce6f-4ae3-a3e6-14272d8003db.filesusr.com/ugd/7be1cd_66175a7317e4464a95243ca4a91b3ed3.pdf?index=true
    • https://f9a132f0-acc9-4761-b7d8-38025aedd849.filesusr.com/ugd/5c71d6_9396b64bd15847529f4cae9e79fef1ca.pdf?index=true
    • http://ralirajuz.atwebpages.com/6975821231.pdf
    • https://s3.amazonaws.com/bewibiwat/bodyguard_movie_in_480p.pdf
    • https://f06ae689-34e6-4fd9-b749-a5985747e370.filesusr.com/ugd/4117a9_a73c6cc9a8eb40a0998defb9db215b4b.pdf?index=true
    • https://s3.amazonaws.com/lomuper/what_does_amo_te_mean.pdf
    • https://2c8134a4-d865-4da1-8961-c755d7242105.filesusr.com/ugd/6dcf04_5197a713edc4424d93ea0d8f4eaf6245.pdf?index=true
    • https://s3.amazonaws.com/fedufiporara/tropical_rainforest_leaves_template.pdf
    • http://xovolefewawex.atwebpages.com/who_makes_the_best_lawn_mower_battery.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ed36.bin
382cc8e36a64069d27b91e205047f10bd69623002e01c0b7f4db4f7d71b994ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED36 5400 bytes
font_01_sfnt_off0000ff78.bin
27f649a9d0ade3ca39c4367dfabe2bee240166c8d07561b53f6dfe261a628324		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFF78 10888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.