Malicious PDF — malware analysis report

Static analysis result for SHA-256 01597eeeb1b681e7…

MALICIOUS

PDF

34.2 KB Created: 2018-06-11 09:44:15 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: f590a6c570473162b0f417345176e2a6 SHA-1: 03f06facd4ca3b8e44a2853e2b97116e7ce3f889 SHA-256: 01597eeeb1b681e78849ad87d3444b15bfdf6088eac9006e05029f7e9f8d0fa7
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF is flagged as a fake 'free download' SEO-poisoning document. It contains a malicious URI pointing to 'uncpbisdegree.com/download3.php', which is likely used to serve a second-stage payload. The document body, though heavily obfuscated, contains references to the malicious URL and appears to be a lure for a book download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9340

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=vampire-forgotten-vampires-destined-book-2.pdf
    • http://uncpbisdegree.com/download4.php?q=vampire-forgotten-vampires-destined-book-2.pdf
    • http://www.monsterlibrarian.com/vampiresya.htm
    • http://season-release-date.com/vampire-knight-season-3-release-date/
    • https://www.maryse.net/books/my-top-ten-favorite-paranormal-series.html
    • https://readingbookslikeaboss.com/2018-book-releases/
    • http://www.anathemabooks.com/
    • http://riverside-resort.net/1/spiral-vol-5-the-bonds-of-reasoning-v-5.pdf
    • http://riverside-resort.net/1/the-horse-world-of-the-bluegrass.pdf
    • http://riverside-resort.net/1/the-art-amp.pdf
    • http://riverside-resort.net/1/structural-analysis-j-c-smith.pdf
    • http://riverside-resort.net/1/sharp-xe-a106-manual-download.pdf
    • http://riverside-resort.net/1/silver-solutions-usa-coupon-code.pdf
    • http://riverside-resort.net/1/solution-book-of-digital-signal-processing-by-p-ramesh-babu.pdf
    • http://riverside-resort.net/1/thinking-throught-the-imagination-aesthetics-in-human-cognition.pdf
    • http://riverside-resort.net/1/the-art-of-fiction-a-guide-for-writers-and-readers-ayn-rand.pdf
    • http://riverside-resort.net/1/the-gr11-trail-la-senda-through-the-spanish-pyrenees-cicerone-guides.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://blogs.discovermagazine.com/crux/2015/03/26/real-life-vampires-exist/
    • https://www.amazon.com/Shade-Vampire-New-Lengthened-2015-ebook/dp/B00AOHDMFE
    • https://www.amazon.com/Kindle-eBooks/b?ie=UTF8&node=154606011
    • https://www.amazon.com/Teen-Young-Adults-Kindle-eBooks/b?ie=UTF8&node=3511261011
    • https://en.wikipedia.org/wiki/Marcus_Wesson
    • https://en.wikiquote.org/wiki/Buffy_the_Vampire_Slayer
    • https://en.wikipedia.org/wiki/Legacy_of_Kain
    • https://en.wikipedia.org/wiki/PlayStation_4
    • https://en.wikipedia.org/wiki/Legacy_of_Kain:_Dead_Sun
    • https://www.barnesandnoble.com/w/destined-p-c-cast/1030032172
    • http://buffy.wikia.com/wiki/Spike
    • http://tvtropes.org/pmwiki/pmwiki.php/Main/SuperEmpowering
    • http://rosariovampire.wikia.com/wiki/Kurumu_Kurono
    • http://buffy.wikia.com/wiki/Cordelia_Chase
    • http://tvtropes.org/pmwiki/pmwiki.php/Main/FantasyKitchenSink
    • https://www.goodreads.com/book/show/10692.The_Historian
    • https://www.fanfiction.net/u/2545794/HotelKatz
    • https://www.librarything.com/topic/4119
    • https://www.fanfiction.net/u/2796140/Dragons-Twilight1992
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000497e.bin
dfd09f869c54702d9949206e2fbd4ccf443dd6b3c2cef3e60ef92836abbf1cda		 pdf-font-stream PDF embedded font (sfnt) at offset 0x497E 10292 bytes
font_01_sfnt_off00006a32.bin
63352789c07e5f3090313c53027afc4712d275dd374c65bc41c919a0546f5a0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A32 7384 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.