PDF malware analysis — malicious · 146e57b9298afc66

MALICIOUS

PDF

89.1 KB Created: 2021-04-16 17:34:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-08-20

MD5: 1733995988276ed748b1fd655c5a8c8e SHA-1: 229033aa4dcf56126aeeed3cbf72070be9fb1db9 SHA-256: 146e57b9298afc66b7be66cfb8dc4f3832c0012bf74831ca770e9e73fe8d643c

196 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was identified as malicious by ClamAV and an ML classifier. It contains a large number of external links, many of which point to SEO-optimized pages designed to redirect users to potentially malicious content. The primary malicious URL identified is https://dugedepap.ru/strik?utm_term=what+is+the+importance+of+the+pauline+epistles, which is part of a link farm strategy.

Machine Learning

Nyx PDF Classifier malicious score 0.9998

Heuristics 6

ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image lure linking to an SEO redirector (free-download phishing) high PDF_SEO_UTM_REDIRECTOR_LINK

PDF embeds an image with little or no body text and a clickable link to a multi-word utm_term / FeedBurner-proxied SEO redirector — the 'free ebook / solution-manual / document download' phishing family that ranks for natural-language search queries and routes the user into a payload/redirect chain. The PDF carries no exploit; the risk is the linked destination. Flagged structurally (image lure + SEO redirector) so it does not depend on a ClamAV/ML signature, and regardless of how many filler text pages the lure carries.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://dugedepap.ru/strik?utm_term=what+is+the+importance+of+the+pauline+epistles PDF link annotation
- http://gbarb.me/warren_buffett_gold_quote0njsm.pdfIn PDF document text
- http://tipopajokoti.iblogger.org/fimaza.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4446038/normal_605c09563a733.pdfIn PDF document text
- http://navaram.online/romeo_and_juliet_act_1_lessonsgejl2.pdfIn PDF document text
- https://cdn-cms.f-static.net/uploads/4367645/normal_604fedef8bb51.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- http://www.daltonmaag.com/In PDF document text
- https://s3.amazonaws.com/zarevizebi/new_hollywood_bollywood_movies_free.pdfIn PDF document text
- http://gamebunamol.rf.gd/academic_vocabulary_list_for_ielts.pdfIn PDF document text
- https://6da1ed31-7a22-45b0-8bc5-463d376071ee.filesusr.com/ugd/29fbaf_096675a217904fd4aedffc0f50d8658a.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/lososimap/simplifying_multiplying_and_dividing_radicals_worksheet.pdfIn PDF document text
- https://00407fa8-a9ef-4b78-9bbe-46147fc8acf6.filesusr.com/ugd/5ecadc_efbbf2c5de954a89b5c72c7fa30d9d27.pdf?index=trueIn PDF document text
- http://wowejatilubus.epizy.com/mabekixosi.pdfIn PDF document text
- http://xebowuruno.epizy.com/89996606415.pdfIn PDF document text
- https://s3.amazonaws.com/rubidokezive/crohn_s_disease_guideline.pdfIn PDF document text
- https://893c8be9-d140-4a04-8a3e-66bd54b472cd.filesusr.com/ugd/efd7ea_891113c51aa94ccdadd3d378b26487b8.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/baposivarabuj/lagafimaluzatafar.pdfIn PDF document text
- https://68e1e3d4-268d-49bc-a8aa-b119cb10fea7.filesusr.com/ugd/3ceeb9_f78a6d5ad333443cb479fc77469e3e32.pdf?index=trueIn PDF document text
- https://s3.amazonaws.com/luborinizu/27350895572.pdfIn PDF document text
- https://40fd9d30-e691-4ad4-9ff9-7de67b304886.filesusr.com/ugd/45b27a_59452989eb454ee7b824f6f11c1948ca.pdf?index=trueIn PDF document text
- https://d4bcd744-2348-4fe3-9006-05b2fcbd3cbd.filesusr.com/ugd/704566_e513abaefa5d4e99b89837ed50c78114.pdf?index=trueIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00011206.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11206	5152 bytes
SHA-256: `d0227ca5efae3b8acd3830b2cf6f775674b78a7c6578143a621905684ff13aff`
`font_01_sfnt_off00012365.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x12365	11116 bytes
SHA-256: `b797d2e01c13ad01f5ce85474e2535852b439f28ff4b91fbb90b5ad169ea8500`
`font_02_sfnt_off000148d2.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x148D2	4324 bytes
SHA-256: `d1f4a20f0e35a0564be54678b929bb8c711862c507f070c2b9a6abea8daf4378`

Open this report in the interactive analyzer, or submit your own file for analysis.