Malicious PDF — malware analysis report

Static analysis result for SHA-256 501bd2e4e666e8c1…

MALICIOUS

PDF

77.7 KB Created: 2021-03-10 03:29:25 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ca30265e619a20c240667e7e38dc1867 SHA-1: 07fe5447e43dd582c92d777d9bee887d72ab3202 SHA-256: 501bd2e4e666e8c1e18278566626d2cc1695e32853a4373878b7dcc82cc5d1bc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ML classifiers and ClamAV as malicious, with a high risk score. It contains an embedded URI pointing to 'druttle.ru', which is likely a phishing or malware distribution domain. The document body, though heavily obfuscated, contains keywords related to salary raises, suggesting a social engineering lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/award?keyword=salary+raise+letter+pdf
    • http://labifovejes.mypressonline.com/creative_writing_prompts_for_4th_grade.pdf
    • https://cdn.sqhk.co/lasanamemego/ehhPhgc/27963939375.pdf
    • https://cdn.sqhk.co/tuxonewebuke/h13mwZs/rogue_hearts_apk.pdf
    • http://kofojoxake.mygamesonline.org/debi_humayun_ahmed_movie.pdf
    • http://paxezot.getenjoyment.net/susaludilofo.pdf
    • https://cdn-cms.f-static.net/uploads/4384851/normal_601079edbdd2a.pdf
    • https://static.s123-cdn-static.com/uploads/4369776/normal_5ffd992bbea96.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.daltonmaag.com/
    • https://s3.amazonaws.com/memexelu/xifujalisaxaru.pdf
    • https://77047a80-9f17-4504-a563-a097c25ca12e.filesusr.com/ugd/5c8b2f_187db33c6f0d4efbae45c53ddf6e8000.pdf?index=true
    • https://ad858f6a-7bbb-416d-9365-e04d7986ed9b.filesusr.com/ugd/3c9ac1_69f5fda3040b4275b1f35e61710a14a8.pdf?index=true
    • https://s3.amazonaws.com/wejuvono/charmed_1998_season_2.pdf
    • https://b6c9d0de-81a1-4db9-ab7d-8a95af9e63d6.filesusr.com/ugd/b28ae2_61bab6d6964149b7aabfef03c1306db1.pdf?index=true
    • https://s3.amazonaws.com/vufuzewasi/amazon_fire_phone_firmware.pdf
    • https://s3.amazonaws.com/mejigavukolu/disgaea_5_complete_beginner_guide.pdf
    • https://101c3d73-5e22-4da1-a203-a3a2a794ce88.filesusr.com/ugd/69a512_96a85aacfeb3467e9315befe3b8aacac.pdf?index=true
    • https://6e678f60-abc6-404c-883a-cd1729fdffee.filesusr.com/ugd/e4291f_a374d0ffad8f4f3dbb90ae657cd39c7d.pdf?index=true
    • https://86042ffc-9b62-460b-8552-fb2522205a17.filesusr.com/ugd/4f92c1_fd2439eb6db04a6ab367fd41f175e1aa.pdf?index=true
    • https://dbba0f06-1911-40f0-8c80-a2638c7f81cc.filesusr.com/ugd/b13fd1_3b018002b445413bb9713ce893d44580.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e745.bin
c93e1a9f136bcdbd159350712d696db03d108722556cbfaf5e2e81e73169da88		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE745 4812 bytes
font_01_sfnt_off0000f7af.bin
dc7bff69607db0671f0f942d9f78ccbff89d77f7bb1a052c4630f13a7b96a132		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF7AF 10588 bytes
font_02_sfnt_off00011bb4.bin
7f6049e5011acf0e8581793f2bc2bb947aac2929fdb77abc318b2a6155c1ef71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11BB4 4324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.