Malicious PDF — malware analysis report

Static analysis result for SHA-256 22566680f539fd11…

MALICIOUS

PDF

46.1 KB Created: 2020-08-10 03:40:00 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e6001cb488966494f3d473dae0e19532 SHA-1: e3912e4266c9272b91268382b443c8e0bf3a372f SHA-256: 22566680f539fd118a70fffc819777dc9dfbb88090c2b3877e00bcd6be6dd1b9
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains a malicious link disguised as a 'cease and desist letter harassment' document. This link redirects to a known malicious redirector (ttraff.cc), which is designed to lead users to further malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external links, many pointing to Shopify, suggests an attempt to manipulate search engine results or distribute malicious content through seemingly benign platforms.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.cc/pify?keyword=cease+and+desist+letter+harassment+pdf+uk
    • http://files.clquilters.org/uploads/1/3/1/4/131438248/128606c.pdf
    • http://files.idatasci.com/uploads/1/3/2/6/132682785/611ed.pdf
    • http://files.kinseyyoungquistlmp.com/uploads/1/3/1/4/131483083/181083.pdf
    • https://cdn.shopify.com/s/files/1/0441/4432/8856/files/kerokukena.pdf
    • https://cdn.shopify.com/s/files/1/0434/1907/4712/files/callan_method_book_2.pdf
    • https://cdn.shopify.com/s/files/1/0431/8904/3358/files/38691478128.pdf
    • https://cdn.shopify.com/s/files/1/0431/7052/9436/files/reduced_row_echelon_form_calculator.pdf
    • https://cdn.shopify.com/s/files/1/0433/3685/9813/files/99013742872.pdf
    • https://cdn.shopify.com/s/files/1/0427/4785/5004/files/windows_registry.pdf
    • https://cdn.shopify.com/s/files/1/0432/4235/6904/files/32150336382.pdf
    • https://cdn.shopify.com/s/files/1/0428/3249/4751/files/test_credit_card_numbers_with_cvv.pdf
    • https://cdn.shopify.com/s/files/1/0427/7927/9527/files/82943021252.pdf
    • https://cdn.shopify.com/s/files/1/0436/5264/5017/files/auto_insurance_policy.pdf
    • https://cdn.shopify.com/s/files/1/0435/4169/2570/files/classes_d_d.pdf
    • https://cdn.shopify.com/s/files/1/0427/6623/7852/files/70511404613.pdf
    • https://cdn.shopify.com/s/files/1/0429/5373/6351/files/55261581364.pdf
    • https://cdn.shopify.com/s/files/1/0430/9336/0791/files/sasadugawexanabomofaf.pdf
    • https://cdn.shopify.com/s/files/1/0432/5693/8646/files/alternariose_de_la_pomme_de_terre.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://cdn.shopify.com/s/files/1/0431/7052/9436/files/reduced_row_echelon_form_c

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075b5.bin
ef4e9865d0992dc5ede3469202435bc1ad44064ceb9af4263d5910ed00989a2a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75B5 5248 bytes
font_01_sfnt_off0000875c.bin
5c5e19c94c19325aa88a2f11dfc16d89c8a6fceeede07e6c8ef95eb7399da712		 pdf-font-stream PDF embedded font (sfnt) at offset 0x875C 10584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.