Malicious PDF — malware analysis report

Static analysis result for SHA-256 08cb6ad84142ceb0…

MALICIOUS

PDF

31.2 KB Created: 2018-06-11 10:01:05 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 608005a6ed75fa907a525a5afc237e12 SHA-1: 7d23f744a7d1ebce24b11d9dbcc9d292d4531768 SHA-256: 08cb6ad84142ceb0b340fcf72340158f0dff92900279d6987efa5dd7996f2e42
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF was flagged by multiple heuristics as a fake download lure, specifically targeting users searching for technical manuals. The embedded URL http://uncpbisdegree.com/download3.php?q=volvo-penta-inboard-diesel-md2030.pdf is the primary indicator of malicious intent, likely serving as a gateway to a secondary payload. The ML classifier and ClamAV detection further support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9276

Heuristics 5

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • ClamAV: Pdf.Dropper.Agent-9250276-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9250276-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=volvo-penta-inboard-diesel-md2030.pdf
    • http://uncpbisdegree.com/download4.php?q=volvo-penta-inboard-diesel-md2030.pdf
    • http://www.marinepartsexpress.com/prodbull/md2030.pdf
    • http://www.firstrowsportsv.com/volvo-penta-dp-s-workshop-manual.pdf
    • http://www.marinepartsexpress.com/engines.html
    • http://www.falmouthyachtbrokers.co.uk/shop.aspx?REF=Mercruiser+Fuel+Treatments
    • http://www.falmouthyachtbrokers.co.uk/shop.aspx?REF=Mercruiser+Alpha+One+Gen+2+Sterndrive+Parts
    • http://www.crommarine.se/volvo_penta/diesel-inb.htm
    • http://www.boatinfo.no/lib/library.html
    • http://www.prinsvanoranje.nl/nl/actueel-aanbod.html
    • http://www.balmar.net/operation-manuals/
    • http://www.maiden-marine.co.uk/brokerage/
    • http://www.balmar.net/
    • http://www.sailfaryachts.com/forsale/
    • http://riverside-resort.net/1/the-great-buddhist-stories-omnibus.pdf
    • http://riverside-resort.net/1/toyota-3gr-fse-engine-repair-manual.pdf
    • http://riverside-resort.net/1/shadow-gate-crossroads-2-kate-elliott.pdf
    • http://riverside-resort.net/1/the-handmaids-tale-margaret-atwood.pdf
    • http://riverside-resort.net/1/sports-coaching.pdf
    • http://riverside-resort.net/1/tourism-and-economic-development.pdf
    • http://riverside-resort.net/1/the-niv-application-commentary-james.pdf
    • http://riverside-resort.net/1/the-american-civil-war-essential-histories.pdf
    • http://riverside-resort.net/1/the-overachievers-secret-lives-of-driven-kids-alexandra-robbins.pdf
    • http://riverside-resort.net/1/the-noisy-stable-and-other-christmas-stories.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=NL_EN&a=http%3a%2f%2fwww.prinsvanoranje.nl%2fnl%2factueel-aanbod.html
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ea2.bin
620986c581b09882805492649504f7ea3308b40dfd900a20dec083e9a2945feb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3EA2 10076 bytes
font_01_sfnt_off00005ec2.bin
d69a20beafa245d05061c33341dee549c7de1b0ac86634743d80903a85102ae2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EC2 7488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.