Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5e3d67fb0d43426…

MALICIOUS

PDF

90.4 KB Created: 2021-05-30 19:09:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-11-24
MD5: c307c5d616f7632cfe52409164e4a9f8 SHA-1: 5362773795a84939e80dbecab32da46ab0ba228c SHA-256: b5e3d67fb0d434266a0287483cc9d3a64c84a5e5cf8d84c9827f5a2eb76683cf
164 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file is identified as malicious by multiple heuristics, including a critical ClamAV detection and an ML classifier. The 'SE_INVOICE_LURE' heuristic, combined with the embedded URL pointing to 'druttle.ru', strongly suggests a phishing attempt disguised as an invoice update. While no scripts were explicitly extracted, the PDF structure and URI findings indicate it's designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/123?utm_term=atualizar+boleto+santander+pdf PDF link annotation
    • https://weziriditovi.weebly.com/uploads/1/3/4/1/134108838/1972f3aaf6cba76.pdfIn PDF document text
    • https://xipunozelizu.weebly.com/uploads/1/3/1/3/131382486/af946fb5ee9.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/9de4cf10-277a-4f0b-a2c6-701dbce09e62/lojiboxusek.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/986b414f-2d3b-4d0f-8eff-a5ad9050b5af/biografia_aurora_valle_wikipedia.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9e2bedc7-5ea8-4691-8cd1-c2004462652a/95211830596.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d94ceb04-3ba4-4f5e-b4f0-b14b68e2cfec/minecraft_pe_shaders_2019_ios.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2008580b-4c9e-4225-98ae-33b7d01f7a5b/what_can_i_eat_on_a_7_day_detox.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c9216b29-7057-49bf-8c8a-cb1796385f07/79473412467.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9b19110-8cd2-435e-ac06-7d648b829e18/sock_loom_toe_instructions.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/298bd892-1911-4506-a669-a44d43f1db29/rexijugivo.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/447c9aa0-d2d5-417b-94f0-61336825d0a6/how_much_do_visiting_angels_make.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/703521b5-d859-4803-97c3-0e1681ff2eb0/english_grammar_notes.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/81392cd0-946f-4715-8228-bd6c472bcc3f/geweluxezasibipedozikemik.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/d4b407d7-05be-41c0-9a10-0ae93161a367/how_to_program_directv_remote_to_lg_soundbar.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9a30d21-7afc-46f9-b371-f81517cb0dc2/how_to_connect_remote_to_receiver.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/fa28ac13-8e06-4377-8125-2c156b166be9/how_to_replace_cmos_battery_in_dell_inspiron_1440.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/63b30657-4dc8-4cf7-93bc-7df4d931ef8e/what_is_a_therapeutic_staff_support_worker.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/ec943266-baf1-4880-9f78-128389f4526b/fundamentals_of_pathology_of_skin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/54e01d7a-77e3-4125-93d5-3e86750bd809/sevojewigepe.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/66a48e6d-191c-47e2-9a89-9829c83d5a30/67459485021.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/c0e90fa6-d9c7-4a90-a1e2-e8c4acbda0dc/wotivit.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010b6b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10B6B 5212 bytes
SHA-256: b548cd04d0ab8b9f47d52307d85084801f433e3c3338b87fa70f18a6b012cc13
font_01_sfnt_off00011d31.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D31 13380 bytes
SHA-256: e84e139534ce16df8ba8cd4d962d727be358951ed695d00c4461241701fb6cca
font_02_sfnt_off00014593.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14593 16140 bytes
SHA-256: 5bfda07072dd2e1b0df7f1680a75ba616774ec51e1a09c257f000ba239241e1c

Open this report in the interactive analyzer, or submit your own file for analysis.