Malware — Trojan Dropper Masquerading as PDF Utility
Microsoft Defender for Endpoint detected and quarantined Trojan:Win64/Malgent!MSR during a scheduled scan. Delivered as a trojan dropper disguised as an update binary for PDFSkills. VirusTotal: 30/72 engine detection. Code-signing certificate issued to RED ROOT LTD — a known malicious signing entity. Defender prevented execution before payload deployed. No lateral movement, C2, or data exfiltration observed. Single endpoint scope confirmed.
Trojan droppers are a class of malware designed to deliver a secondary payload — their function is not to cause harm directly, but to establish a foothold and retrieve additional malicious components, typically via a C2 callback. The dropper is small by design (this one was 20.76 KB) because its job is simply to execute, reach out, and pull down the real payload.
PDFSkills is a third-party PDF utility application that has been documented as a known PUP (Potentially Unwanted Program) and malware delivery vector. Software distributed through unofficial channels or bundled with adware frequently includes update mechanisms that are themselves malicious — the Update.exe binary in this incident is precisely this: a trojan dropper masquerading as a legitimate application updater.
The detection gap in this incident is analytically significant. The file was not caught at installation by real-time protection — it was only detected during a subsequent scheduled scan. This means the dropper was dormant on the endpoint for an indeterminate period. While Defender ultimately quarantined it before execution, the window between file creation and detection is a material risk factor that must be quantified via the FileCreated timestamp query.
The binary (Update.exe) was quarantined from C:\Users\[REDACTED]\AppData\Local\PDFSkills — a user-space path that requires no administrative privileges, allowing the dropper to persist without triggering UAC prompts. This AppData\Local install path is a consistently abused location by malware that cannot escalate to system paths.
SHA1 hash submission to VirusTotal returned 30/72 positive engine detections — a strong malicious consensus that removes any false positive doubt. Defender's classification (Trojan:Win64/Malgent!MSR) is a generic dropper family designation, consistent with a loader/dropper architecture that hasn't been attributed to a specific named threat actor group.
The code-signing certificate presented by the binary was issued to RED ROOT LTD — a documented malicious code-signing entity with no association to any legitimate software vendor. Signed malware exploits the trust that operating systems and security products extend to signed executables; the presence of a certificate from RED ROOT LTD is an unambiguous red flag with no legitimate explanation.
Process tree analysis confirmed no child processes were spawned from the PDFSkills directory — Defender quarantined the binary before it could execute. Network connection review found no external connections from the PDFSkills path, confirming no C2 callback was attempted during the detection window. Credential access indicators (LSASS access, credential dumping tools) were absent.
An estate-wide hash hunt using the SHA1 across all Defender-enrolled endpoints returned no additional matches — confirming the incident was scoped to a single endpoint. The user likely downloaded PDFSkills from an unofficial source, as the application is not part of the organisation's approved software catalogue.
| Type | Indicator | Notes |
|---|---|---|
| File Name | Update.exe | Trojan:Win64/Malgent!MSR — dropper binary masquerading as application updater |
| File Path | C:\Users\[REDACTED]\AppData\Local\PDFSkills\Update.exe | User-space path — no admin privileges required for installation |
| File Size | 20.76 KB | Consistent with lightweight dropper/loader architecture |
| SHA1 | 661fbb34201f2ca094c8b75b6248017cecf33e85 | VirusTotal: 30/72 engines — strong malicious consensus |
| Cert Signer | RED ROOT LTD | Known malicious code-signing entity — no legitimate software association |
| Malware Family | Trojan:Win64/Malgent!MSR | Microsoft Defender generic dropper classification |
| Delivery Vehicle | PDFSkills application | Third-party PDF utility — known PUP/malware delivery vector |
| Tactic | Technique | ID | Observed |
|---|---|---|---|
| Initial Access | Drive-by Compromise / User Execution | T1189 / T1204 | User likely downloaded PDFSkills from an unofficial or malicious source |
| Execution | User Execution: Malicious File | T1204.002 | Update.exe dropper planted in user profile space |
| Persistence | Boot or Logon Autostart (AppData) | T1547 | AppData install path enables auto-run without admin rights |
| Defense Evasion | Subvert Trust Controls: Code Signing | T1553.002 | Signed with RED ROOT LTD certificate to exploit trust in signed binaries |
| C2 (Attempted) | Application Layer Protocol | T1071 | Dropper architecture suggests C2 callback — no confirmed connection observed |
// Confirm quarantine status and file path
DeviceEvents
| where DeviceName == "[HOSTNAME]"
| where FileName == "Update.exe"
| project Timestamp, ActionType, FolderPath, SHA1, InitiatingProcessFileName
// Check for child processes spawned from PDFSkills directory
DeviceProcessEvents
| where DeviceName == "[HOSTNAME]"
| where InitiatingProcessFolderPath contains "PDFSkills"
| project Timestamp, FileName, ProcessCommandLine, InitiatingProcessFileName
// Hunt for C2 callback attempts
DeviceNetworkEvents
| where DeviceName == "[HOSTNAME]"
| where InitiatingProcessFolderPath contains "PDFSkills"
| where RemoteIPType != "Private"
| project Timestamp, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
// Estate-wide hash hunt
DeviceFileEvents
| where SHA1 == "661fbb34201f2ca094c8b75b6248017cecf33e85"
| project DeviceName, FolderPath, Timestamp, ActionType
// Determine when file was first written to disk (real-time gap assessment)
DeviceFileEvents
| where DeviceName == "[HOSTNAME]"
| where FileName == "Update.exe" and FolderPath contains "PDFSkills"
| where ActionType == "FileCreated"
| project Timestamp, ActionType, FolderPath, SHA1RED ROOT LTD as the signing entity is an unambiguous red flag — this is not a borderline detection. The 30/72 VT ratio confirmed malicious classification with high confidence.
The most significant analytical question is the detection gap: the file was present on the endpoint and was not detected in real-time. The FileCreated query is critical for establishing how long the dropper was dormant and whether there was a network connectivity window during which callbacks could have been attempted.
The AppData\Local install path is worth flagging in all client advisories — this path is consistently abused by malware that cannot write to system paths and is a reliable indicator of non-privileged malware installation.