MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to 'druttle.ru', which is likely used to redirect the user to a malicious site for further exploitation. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection suggest a phishing or malware distribution attempt.
Machine Learning
- Nyx PDF Classifier malicious score 0.9995
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://druttle.ru/wix?keyword=kuwagata+kamakiri+batta
- https://nifogagerosore.weebly.com/uploads/1/3/5/3/135300162/43dfe2ef9.pdf
- https://static.s123-cdn-static.com/uploads/4418987/normal_5ff035a2f1d78.pdf
- https://cdn-cms.f-static.net/uploads/4486534/normal_60226753cad46.pdf
- http://rozogididibusar.sportsontheweb.net/68297205928.pdf
- https://sipinawuzukefo.weebly.com/uploads/1/3/1/4/131410227/764026.pdf
- http://bezivodediz.iblogger.org/pdf_to_word_convert_software_download.pdf
- https://sitasujo.weebly.com/uploads/1/3/4/8/134876827/0be56.pdf
- https://static.s123-cdn-static.com/uploads/4444875/normal_6002986745504.pdf
- https://kunulidozejenu.weebly.com/uploads/1/3/3/9/133997834/4ed10d7aabad21.pdf
- https://cdn-cms.f-static.net/uploads/4382961/normal_6054bc0b4eb15.pdf
- https://jukatuve.weebly.com/uploads/1/3/2/7/132741058/godixuwenugubugaso.pdf
- https://cdn.sqhk.co/vorebilifi/hHTVgvi/19012547723.pdf
- https://cdn.sqhk.co/ganuniwiku/jhaihTI/27760752321.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://bifovigavij.myartsonline.com/pewulumugabokapaga.pdf
- https://e192e36c-395d-4660-9df6-aa7aed00c30a.filesusr.com/ugd/3aee12_b3d4eefdf4bc4f12893856f80653fe98.pdf?index=true
- https://1801fa0f-56e4-4894-8452-b8e06651d4be.filesusr.com/ugd/868401_dbe074370218400588c901ec597cf8ee.pdf?index=true
- https://3e021c9a-284a-4c54-9ba1-f6d43d4d2ba5.filesusr.com/ugd/a619af_8c370e4fd3b54c0f9bcc366072ae7e76.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off000228bd.bin08f7fa1bd0e4928751d3210ca2c7e1602b5b152b67bc6a84188297c375644eb4 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x228BD | 40740 bytes |
font_01_sfnt_off0002a433.binc05a549569c2b069dc5e66185827a2810ce82a447dde270e5025f58078f461a8 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2A433 | 5060 bytes |
font_02_sfnt_off0002b56e.bin0a44119347bf3b516f3d50f432b99b4b886bf65e17d809e841d84890a09e5d76 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x2B56E | 12476 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.