Malicious PDF — malware analysis report

Static analysis result for SHA-256 d25b9614e47fce8f…

MALICIOUS

PDF

187.0 KB Created: 2021-03-22 02:44:59 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bbfb114eda2c30b000b600b05594950f SHA-1: 187bf5cb771edd660127059b6030342b13f957bb SHA-256: d25b9614e47fce8f483e1e7b44df9ece23d1cc5bd6dd67d72d57656442b5edeb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The file was detected as malicious by ML classifiers and ClamAV, indicating a high likelihood of malicious intent. The PDF contains an embedded URI pointing to 'druttle.ru', which is likely used to redirect the user to a malicious site for further exploitation. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://druttle.ru/wix?keyword=kuwagata+kamakiri+batta
    • https://nifogagerosore.weebly.com/uploads/1/3/5/3/135300162/43dfe2ef9.pdf
    • https://static.s123-cdn-static.com/uploads/4418987/normal_5ff035a2f1d78.pdf
    • https://cdn-cms.f-static.net/uploads/4486534/normal_60226753cad46.pdf
    • http://rozogididibusar.sportsontheweb.net/68297205928.pdf
    • https://sipinawuzukefo.weebly.com/uploads/1/3/1/4/131410227/764026.pdf
    • http://bezivodediz.iblogger.org/pdf_to_word_convert_software_download.pdf
    • https://sitasujo.weebly.com/uploads/1/3/4/8/134876827/0be56.pdf
    • https://static.s123-cdn-static.com/uploads/4444875/normal_6002986745504.pdf
    • https://kunulidozejenu.weebly.com/uploads/1/3/3/9/133997834/4ed10d7aabad21.pdf
    • https://cdn-cms.f-static.net/uploads/4382961/normal_6054bc0b4eb15.pdf
    • https://jukatuve.weebly.com/uploads/1/3/2/7/132741058/godixuwenugubugaso.pdf
    • https://cdn.sqhk.co/vorebilifi/hHTVgvi/19012547723.pdf
    • https://cdn.sqhk.co/ganuniwiku/jhaihTI/27760752321.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://bifovigavij.myartsonline.com/pewulumugabokapaga.pdf
    • https://e192e36c-395d-4660-9df6-aa7aed00c30a.filesusr.com/ugd/3aee12_b3d4eefdf4bc4f12893856f80653fe98.pdf?index=true
    • https://1801fa0f-56e4-4894-8452-b8e06651d4be.filesusr.com/ugd/868401_dbe074370218400588c901ec597cf8ee.pdf?index=true
    • https://3e021c9a-284a-4c54-9ba1-f6d43d4d2ba5.filesusr.com/ugd/a619af_8c370e4fd3b54c0f9bcc366072ae7e76.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000228bd.bin
08f7fa1bd0e4928751d3210ca2c7e1602b5b152b67bc6a84188297c375644eb4
pdf-font-stream PDF embedded font (sfnt) at offset 0x228BD 40740 bytes
font_01_sfnt_off0002a433.bin
c05a549569c2b069dc5e66185827a2810ce82a447dde270e5025f58078f461a8
pdf-font-stream PDF embedded font (sfnt) at offset 0x2A433 5060 bytes
font_02_sfnt_off0002b56e.bin
0a44119347bf3b516f3d50f432b99b4b886bf65e17d809e841d84890a09e5d76
pdf-font-stream PDF embedded font (sfnt) at offset 0x2B56E 12476 bytes