PDF malware analysis — malicious · 749032aad3cbca67

MALICIOUS

PDF

82.6 KB Created: 2021-02-25 14:49:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-20

MD5: 9986030d824f714bf3493c5c14d5a468 SHA-1: e56503eba3ab697b8b0f96d603b4951f1ccb5a08 SHA-256: 749032aad3cbca67e2f0c554678cf7ef8228437605477c9ad1d118669f7fda3d

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by ClamAV as Pdf.Phishing.Trojan and a machine learning classifier indicated a high probability of maliciousness. An external URI pointing to 'druttle.ru' was extracted, suggesting a phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references that align with the URL's theme, indicating a lure to a malicious site.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 4

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://druttle.ru/123?utm_term=white+tiger+masked+singer+season+3 PDF link annotation
- https://static.s123-cdn-static.com/uploads/4377115/normal_60086cdacdbfa.pdfIn PDF document text
- https://cdn.sqhk.co/jujejorule/jahdvia/62174602321.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4485152/normal_601e3eeef2342.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4384046/normal_5febc06829011.pdfIn PDF document text
- https://static.s123-cdn-static.com/uploads/4411918/normal_5fcd42e5cf1c2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4417313/normal_60264b23ebcab.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4426832/normal_602447bbc3e3d.pdfIn PDF document text
- https://cdn.sqhk.co/pajijolabalu/hejfBZm/moxubabexix.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://s3.amazonaws.com/luropi/dunixigodemo.pdfIn PDF document text
- http://duzavito.epizy.com/24824812983.pdfIn PDF document text
- http://bipulusesag.epizy.com/bellway_plc_annual_report_2018.pdfIn PDF document text
- http://tivupomemotet.rf.gd/interjections_worksheet_with_answers.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00010468.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10468	5448 bytes
SHA-256: `9ab02b49df6c83f2171ba4f3fa7592f658b0260f02deaa976b17569485423f52`
`font_01_sfnt_off000116d4.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116D4	11908 bytes
SHA-256: `05b5e3d2826a23ca31b74ccb86485db3a48676c8b24700ff62eb7465e9350971`

Open this report in the interactive analyzer, or submit your own file for analysis.