Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e49ae631ab4d019…

MALICIOUS

PDF

34.0 KB Created: 2020-09-17 09:01:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e3dd4cc2978e2e89ecaac76139c67306 SHA-1: 73f44a8bd0fce8ef1e951e644894538afc9ebe89 SHA-256: 0e49ae631ab4d01965c6e1a569672007ea33c5b82218cabee4416d505f596bc3
154 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, with a critical heuristic firing indicating it points to known malicious redirector infrastructure. The document body, though partially corrupted, suggests a lure related to a 'Vitamix parts manual', which is likely a pretext to encourage link clicks. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=vitamix+vm0103+parts+manual
    • http://files.arcadiayouthcouncil.org/uploads/1/3/1/3/131398323/6140097.pdf
    • http://rafun.pninax.com/uploads/1/3/1/4/131453960/jemivilefepurun_gutevikibaga.pdf
    • http://files.boerboeluk.com/uploads/1/3/1/8/131860787/kidimadezunebuloraro.pdf
    • http://pajefo.nowwwriters.ca/uploads/1/3/0/7/130739278/lofovoraza.pdf
    • http://kepefix.idealformsnyc.com/uploads/1/3/0/9/130969430/kusejakibej_lamif_vuror.pdf
    • http://files.amargeauxrai.com/uploads/1/3/2/3/132302833/jitebijezuroge_xetufujefaw.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://21027729-75a2-408e-b3b0-fbe65f73eb0a.filesusr.com/ugd/dad7b5_e4cc1b2e078a427e84247fa2db6f9bf6.pdf?index=true
    • https://a68c171b-69c4-483a-929d-90db5495342f.filesusr.com/ugd/696117_a8fc556699bf4a6995f80145d0164337.pdf?index=true
    • https://b035c71f-5cf6-4d91-9a04-58cb005ee49c.filesusr.com/ugd/c12414_be559ed3c0bb425cb5e27e6440601516.pdf?index=true
    • https://09ff10dd-af4c-472f-bd7f-f1edddd52c6d.filesusr.com/ugd/3ed902_bb17fcff288642e79e2b91b28a5eca0e.pdf?index=true
    • https://87ed88b8-e5c4-4ee5-a525-a4d56549c501.filesusr.com/ugd/c88839_f699646d639f4b788fe3885a22f4a4c0.pdf?index=true
    • https://e57a27ca-f357-4652-9ff8-a0287e6a7865.filesusr.com/ugd/c33cdb_fafd18850c9e45329833e2463fb1797f.pdf?index=true
    • https://6987c1b8-7535-4731-83e6-7bdf8be10ad7.filesusr.com/ugd/7f614e_7c8e6db78d4b4d8cb1ae1e6a297b8416.pdf?index=true
    • https://01ef040b-3702-4cc8-bbcb-989578f3f2e2.filesusr.com/ugd/bcb9fd_5b4fa2522b6b4e9ca8e3fa5ad4edeebf.pdf?index=true
    • https://68f3a27e-da45-4039-816b-6c28338910a9.filesusr.com/ugd/dcfb95_7ed52f22c98641d08d0dcfebc90356e5.pdf?index=true
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000478e.bin
c200deb1d350e7db17ee829a4400a096ab12cbc01b510b30c818f39b80d9ad32		 pdf-font-stream PDF embedded font (sfnt) at offset 0x478E 5416 bytes
font_01_sfnt_off000059f1.bin
43929ff1b22546585130b03de431ced21c3b753f2f9acfb469ead7afb0d8eb74		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59F1 9768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.