Malicious PDF — malware analysis report

Static analysis result for SHA-256 082692858de36592…

MALICIOUS

PDF

33.0 KB Created: 2018-06-11 09:57:10 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: ac3ac0ec21bc5e23b77d29527b2d1351 SHA-1: 354b2b54961b7bd61b97556a9b50240d6784f116 SHA-256: 082692858de36592ec967340b4b0c51ec37af4c40b348aff661e0e7de9860c08
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by an ML classifier and contains heuristics indicating it is a fake download lure designed for SEO poisoning. The document body and embedded URLs point to a malicious domain, http://uncpbisdegree.com/, which likely serves a secondary payload. The presence of a 'download' button lure further supports this malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8500

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=supra-mkiv-engine.pdf
    • http://uncpbisdegree.com/download4.php?q=supra-mkiv-engine.pdf
    • http://mkiv.com/
    • http://mkiv.com/93-98-twin-turbo-faqs-2/
    • http://www.titanmotorsports.com/supramkiv9398.html
    • https://www.suprastore.com/sumk19.html
    • http://www.titanmotorsports.com/valvesandrods.html
    • http://mkiv.supras.org.nz/specs.htm
    • http://www.supracarparts.com/
    • http://www.diseno-art.com/encyclopedia/vehicles/road/cars/toyota_supra.html
    • http://www.superstreetonline.com/how-to/engine/1505-guide-to-understanding-the-toyota-2jz-gte-engine/
    • http://www.superstreetonline.com/how-to/
    • http://www.superstreetonline.com/how-to/engine/
    • http://www.2jzgarage.com/2014/08/toyota-supra-na-tt-conversion-summary-part-1/
    • http://riverside-resort.net/1/vienna-1900.pdf
    • http://riverside-resort.net/1/vertigo-pushkin-vertigo.pdf
    • http://uncpbisdegree.com/1/the-impressionists.pdf
    • http://uncpbisdegree.com/1/the-beauty-queen-of-leenane-and-other-plays-martin-mcdonagh.pdf
    • http://riverside-resort.net/1/wr-grace-logo.pdf
    • http://riverside-resort.net/1/vocabulary-workshop-level-d-unit-7-answers-key.pdf
    • http://riverside-resort.net/1/yamaha-4x4-kodiak-2015-450-owners-manual.pdf
    • http://uncpbisdegree.com/1/the-complete-step-by-step-guide-to-designing-and-teaching-online-courses.pdf
    • http://uncpbisdegree.com/1/the-constitution-test-answers.pdf
    • http://uncpbisdegree.com/1/the-concrete-blonde.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://en.wikipedia.org/wiki/Toyota_Supra
    • https://www.aliexpress.com/popular/supra-mkiv.html
    • https://www.gta5-mods.com/vehicles/toyota-supra-mkiv-tuned-add-on-tuning
    • https://www.autotrader.com/cars-for-sale/Toyota/Supra
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004488.bin
a19b16d83fee9f39d2a881dc8d1f0d7e8426757d6b28b13266162d4e97e0a4aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4488 10632 bytes
font_01_sfnt_off0000663c.bin
b2238a36937e2ab2c24407135372b0a8ac0f46066934c73ed423129853717d14		 pdf-font-stream PDF embedded font (sfnt) at offset 0x663C 7148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.