PDF malware analysis — malicious · 10a168a979eb79b7

MALICIOUS

PDF

35.9 KB Created: 2020-09-03 12:00:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 273404bec20ba56ae92c29a49663ba08 SHA-1: 2657b36c790898af25723c7c58657aa46245c08c SHA-256: 10a168a979eb79b768fe3ecdf8b6ba0201e9f9785f1fa8b35fd55d76674d875f

154 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains embedded URLs, one of which, 'https://ttraff.me/wix?keyword=barito+pacific+annual+report+2016', is flagged as a malicious redirector. The document body also contains this URL and appears to be a lure, using a report title to entice clicks. The ML classifier strongly indicates maliciousness, and the presence of multiple external links suggests a link farm or redirection strategy.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://ttraff.me/wix?keyword=barito+pacific+annual+report+2016
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://static.usrfiles.com/ugd/a3b54b_3872ac3d238642e5a05236dc0cc9bcf3.pdf
- https://static.usrfiles.com/ugd/b8c837_3bf0aa6a44964d9e9b467b3dd839b70e.pdf
- https://static.usrfiles.com/ugd/8716ab_2716c5612d2e4217b7e5a153c0b401b9.pdf
- https://static.usrfiles.com/ugd/b8bbd7_6d70c5fc82584f739ce8c789fd9c1e0b.pdf
- https://static.usrfiles.com/ugd/d1fcfc_bb96e7443c904dafbd1f92b186c14222.pdf
- https://cdn.shopify.com/s/files/1/0431/2131/1910/files/cardboard_chair_design_template.pdf
- https://cdn.shopify.com/s/files/1/0434/3840/7845/files/84117742807.pdf
- https://cdn.shopify.com/s/files/1/0428/4301/3287/files/equipment_hire_agreement_template_uk.pdf
- https://static.usrfiles.com/ugd/b8c837_943b079d70434ac593a1195e24fd1cdf.pdf
- https://static.usrfiles.com/ugd/ae059d_66cd680c0b2643a5bcb116a37707436a.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000046d6.bin` `effd44db06bd8d67a54661941485b905cc2cf5c770e73ca6353fa4d122c4af9c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x46D6	5360 bytes
`font_01_sfnt_off00005927.bin` `ac9ee434d5aa0e35ad01404099f2b6316a22a830c68853b009b3f7abce95ccdd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5927	13252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.