Malicious PDF — malware analysis report

Static analysis result for SHA-256 c33c031d3772b631…

MALICIOUS

PDF

43.7 KB Created: 2021-04-12 05:10:56 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: ccb2460852e6a04776b049de921305d2 SHA-1: 2cf50f3d2d6ca44cad431470ddee676045e59e83 SHA-256: c33c031d3772b6319aa5223812229e364d54f3806f7b7a97d63d6b8f5f7e0ec5
174 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF is identified as a phishing lure due to its image-only nature and embedded clickable link. The heuristic 'PDF_IMAGE_LURE' indicates a typical phishing shape where a screenshot hides an attacker-controlled URL. The presence of numerous external links, including one to 'druttle.ru', further supports this assessment. ClamAV also flagged this file as a 'Pdf.Phishing.Trojan'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.6700

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 43 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/strik?utm_term=video+games+new+york+facebook
    • https://static.s123-cdn-static.com/uploads/4403948/normal_5ff26474b9564.pdf
    • https://cdn-cms.f-static.net/uploads/4445333/normal_5fea10c746ffd.pdf
    • https://panonalosisewe.weebly.com/uploads/1/3/5/3/135316392/e21f2d429fca.pdf
    • https://zujolifuwumew.weebly.com/uploads/1/3/4/7/134773321/6927701.pdf
    • https://cdn-cms.f-static.net/uploads/4459917/normal_5fd7c1f1e99ea.pdf
    • https://cdn-cms.f-static.net/uploads/4470521/normal_60207f3d6a994.pdf
    • https://cdn-cms.f-static.net/uploads/4500674/normal_5fd650f6b9fe9.pdf
    • https://futixaxez.weebly.com/uploads/1/3/4/5/134516919/1352136.pdf
    • https://zavodazokexa.weebly.com/uploads/1/3/4/6/134632977/9721099.pdf
    • https://marotebage.weebly.com/uploads/1/3/4/7/134712984/sosibamomabe.pdf
    • https://uploads.strikinglycdn.com/files/9a3331a4-003a-4adf-ae31-cc22fc8407fa/best_rated_pool_salt_system_system.pdf
    • https://uploads.strikinglycdn.com/files/01d2d910-fee4-4b1d-92b5-48f4a453bea7/cant_install_adobe_acrobat_pro_dc.pdf
    • https://s3.amazonaws.com/dogazisuze/18061851432.pdf
    • https://uploads.strikinglycdn.com/files/4f672c8a-547d-46f5-9571-a1d4391f34e4/73631867310.pdf
    • https://0fecb50d-c8db-4b5c-a67e-01a13b1c0e9a.filesusr.com/ugd/da7c2d_4b53ba47ab4b4a528d7acac8631ced1d.pdf?index=true
    • https://def05634-b969-4265-beeb-1e7d695e9a44.filesusr.com/ugd/6865ce_5aec631923654f50af8e0b62260f7765.pdf?index=true
    • https://uploads.strikinglycdn.com/files/ae4da43d-e3ed-45a8-81e6-dcc8517726b8/25083019937.pdf
    • https://s3.amazonaws.com/papuja/risoriwe.pdf
    • https://uploads.strikinglycdn.com/files/5716ad0b-660b-47b9-bb4c-c73296804111/xijesokapagomunorejutiz.pdf
    • https://s3.amazonaws.com/nisoxow/yin_rk._case_study_research_design_and_methods.pdf
    • https://uploads.strikinglycdn.com/files/5bda3e53-a2b3-4459-ac45-9439037e522d/cateye_mity_3_reset.pdf
    • https://s3.amazonaws.com/luropi/87899602016.pdf
    • https://uploads.strikinglycdn.com/files/3dab3e6d-c86c-4f3e-9d54-87adee980668/fire_and_blood_audiobook_chapters.pdf
    • https://uploads.strikinglycdn.com/files/01656c17-945c-41a9-9c30-af4562b4b8fa/3_5_8_pulgadas_a_milimetros.pdf
    • https://uploads.strikinglycdn.com/files/1ca5999c-9629-4f52-8059-258072d88cd2/lol_patch_notes_10.24b.pdf