Malicious PDF — malware analysis report

Static analysis result for SHA-256 2cf3fd2e2a1c62e2…

MALICIOUS

PDF

217.1 KB Created: 2020-08-10 11:42:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: dab3bce65933ca37a47c50564f419885 SHA-1: da5bab3c0d31a65d47497d9223a6d401614c3c98 SHA-256: 2cf3fd2e2a1c62e2c03d121590daed5d47d2687b2987019055677c771d590415
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a link that redirects to malicious infrastructure, as indicated by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains the same URL, suggesting a social engineering lure for free content. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.ru/pify?keyword=archie+comic+pdf+free
    • http://risowite.dubaiactivelife.com/uploads/1/3/0/8/130874038/ada2572d53.pdf
    • http://files.aultmanorthopaedics.com/uploads/1/3/2/8/132816066/e53d392a4.pdf
    • http://files.heritagemaplefarm.com/uploads/1/3/0/8/130873718/nazelulakof.pdf
    • https://cdn.shopify.com/s/files/1/0428/3216/7068/files/xituzikifob.pdf
    • https://cdn.shopify.com/s/files/1/0431/2160/6820/files/lorumolejotafinut.pdf
    • https://cdn.shopify.com/s/files/1/0444/4851/4215/files/pdf_file_editor_download_for_pc.pdf
    • https://cdn.shopify.com/s/files/1/0431/4556/0226/files/gupiposelodatimuwet.pdf
    • https://cdn.shopify.com/s/files/1/0448/4674/3713/files/thyrite_lightning_arrester.pdf
    • https://cdn.shopify.com/s/files/1/0431/8176/8872/files/rivofujazixukirupokugida.pdf
    • https://cdn.shopify.com/s/files/1/0440/6919/1832/files/pukoguwolixela.pdf
    • https://cdn.shopify.com/s/files/1/0432/6916/1110/files/angular_6_new_features.pdf
    • https://cdn.shopify.com/s/files/1/0433/5088/4505/files/bonebep.pdf
    • https://cdn.shopify.com/s/files/1/0431/6590/9160/files/45929311653.pdf
    • https://cdn.shopify.com/s/files/1/0432/3121/5780/files/91216703829.pdf
    • https://cdn.shopify.com/s/files/1/0434/4525/6352/files/mujubetatejigig.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000314fe.bin
c8a661ea1afd6c9a1bb95254c023bfd48c533aac86c4b508ff50bed360fcaa9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x314FE 4964 bytes
font_01_sfnt_off000325bd.bin
bb903c57084a338015cce722b0731906bb55990ea040b7c9c7215b2379c8a0be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x325BD 15716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.