Malicious PDF — malware analysis report

Static analysis result for SHA-256 06cf20e781a74c1d…

MALICIOUS

PDF

35.6 KB Created: 2018-06-11 09:37:19 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: d2d1020c4a248730b6ff1ddbc5966e7c SHA-1: 3a7c54e406e8d8314b8c7792f3a8baf5227ee5f3 SHA-256: 06cf20e781a74c1d92163013bc020ddbdef21376c70b271b99fae25734f36fb3
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF contains heuristics indicating it is a fake download lure, specifically using SEO poisoning techniques. It embeds multiple URLs, with the primary malicious URL being http://uncpbisdegree.com/download3.php?q=suggestion-d-unite.pdf, which is likely used to deliver a second-stage payload. The document body, though partially corrupted, contains references to search queries and URLs, reinforcing the lure. No scripts were extracted, but the PDF structure and embedded links strongly suggest a malicious download attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9136

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=suggestion-d-unite.pdf
    • http://uncpbisdegree.com/download4.php?q=suggestion-d-unite.pdf
    • http://www.studio-unite.org/
    • http://www.maltesemaniac.com/
    • http://www.sp2a.fr/pdf/CFP2A-2013/sec-sp2a-vap/toux_psychogene.pdf
    • http://www.tellyupdates.com/ishqbaaz-2nd-november-2017-written-episode-update-om-gauri-unite/
    • http://www.thrunite.com/thrunite-tc20-3800-lumen-flashlight/
    • http://www.qmail.org/top.html
    • https://www.footballticketnet.com/manchester-united
    • http://www.acupressure.com/blog/index.php/energy-balancing-acupressure-points-gv-20-and-gv-24-5-how-to-unite-the-pituitary-and-pineal-glands-for-wellness/
    • http://www.unitetheunion.org/uploaded/documents/BusSaferWay11-3896.pdf
    • https://www.qnet.org/
    • https://www.cultofpedagogy.com/social-justice-resources/
    • http://www.cegidd.fr/
    • http://antimatrix.org/Convert/Books/DarylBradfordSmith/DarylBradfordSmith_Rosenthal.html
    • http://www.mcstories.com/Titles/D.html
    • http://zitplace.com/11050-site-blaisdell-queen-upholstered-panel-bed-by-darby-home-co-99af0d3a66aa8ce580e8e92f31e5f9e2.shtml
    • http://uncpbisdegree.com/1/teaching-and-learning-of-physics-in-cultural-contexts.pdf
    • http://riverside-resort.net/1/writing-for-radio-books-for-writers.pdf
    • http://uncpbisdegree.com/1/tesccc-unit-8-lesson-1-precal.pdf
    • http://uncpbisdegree.com/1/the-hummingbird-anna-fekete.pdf
    • http://uncpbisdegree.com/1/servicing-audio-and-hi-fi-equipment.pdf
    • http://riverside-resort.net/1/what-emerging-technologies-will-make-geothermal-energy-more-efficient.pdf
    • http://uncpbisdegree.com/1/taoist-yoga-weiser-classics.pdf
    • http://uncpbisdegree.com/1/the-fall-of-rome-and-the-end-of-civilization.pdf
    • http://riverside-resort.net/1/west-virginia-board-of-education.pdf
    • http://uncpbisdegree.com/1/sestep-290-user-manual.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://en.wikipedia.org/wiki/Unite_the_Right_rally
    • https://en.wikipedia.org/wiki/Gagauzia
    • https://www.adidas.com/us/originals
    • https://www.foreignaffairs.com/articles/united-states/2018-05-08/friends-benefits
    • https://www.theguardian.com/us/commentisfree
    • https://www.washingtonpost.com/news/politics/wp/2017/12/08/roy-moore-america-was-great-in-era-of-slavery-is-now-focus-of-evil-in-the-world/
    • https://fr.wikipedia.org/wiki/%C5%92cum%C3%A9nisme
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=FR_EN&a=https%3a%2f%2ffr.wikipedia.org%2fwiki%2f%25C5%2592cum%25C3%25A9nisme
    • http://memory-alpha.wikia.com/wiki/Klingon
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=FR_EN&a=http%3a%2f%2fwww.cegidd.fr%2f
    • https://fr.wikipedia.org/wiki/Wikip%C3%A9dia:Liste_de_fautes_d%27orthographe_courantes
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=FR_EN&a=https%3a%2f%2ffr.wikipedia.org%2fwiki%2fWikip%25C3%25A9dia%3aListe_de_fautes_d%2527orthographe_courantes
    • http://post.queensu.ca/~forsdyke/theorimm0.htm
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005026.bin
af4c67370cc6deaf0420f6fa97081108e610d557c17433f0377dd7735c27bebe
pdf-font-stream PDF embedded font (sfnt) at offset 0x5026 10268 bytes
font_01_sfnt_off000070ca.bin
e13a3375da999e4976678c560090a860e32a718960db66b4bcb76a6705d31178
pdf-font-stream PDF embedded font (sfnt) at offset 0x70CA 6768 bytes