PDF malware analysis — malicious · 0bbd046c3c06530a

MALICIOUS

PDF

29.0 KB Created: 2018-06-11 08:59:05 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)

MD5: b91f1ca34ab25fa58749e5d058b83ac1 SHA-1: e129a71237ee908c4cec6992e5cefb03ac378235 SHA-256: 0bbd046c3c06530abdda4022698c68f37ceabd2d27da697f06773d19c155c116

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains heuristics indicating it is a fake 'free download' SEO-poisoning document. It embeds multiple URLs, including a primary gateway at http://uncpbisdegree.com/download3.php?q=wombat-goes-walkabout-paperback.pdf, which is likely intended to deliver a malicious payload. The document body also contains this URL, reinforcing the lure.

Machine Learning

Nyx PDF Classifier malicious score 0.9281

Heuristics 4

Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD

The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://uncpbisdegree.com/download3.php?q=wombat-goes-walkabout-paperback.pdf
- http://uncpbisdegree.com/download4.php?q=wombat-goes-walkabout-paperback.pdf
- http://events.digitalfertilizer.org/wo/wombat-goes-walkabout-paperback-mxawypaj.pdf
- http://www.janesoceania.com/australia_aboriginal_mythology1/index1.htm
- http://riverside-resort.net/1/unlock-code-a-cingular-sony-ericsson-w300i.pdf
- http://uncpbisdegree.com/1/the-indian-stock-market-to-buy-or-not-to-buy.pdf
- http://uncpbisdegree.com/1/tally-mcq-question-and-answers.pdf
- http://uncpbisdegree.com/1/the-dress-shop-of-dreams-menna-van-praag.pdf
- http://riverside-resort.net/1/vocabulary-workshop-book-e-answers.pdf
- http://uncpbisdegree.com/1/the-essential-bernie-sanders-and-his-vision-for-america.pdf
- http://uncpbisdegree.com/1/staar-reporting-categories-algebra-1.pdf
- http://uncpbisdegree.com/1/solution-manual-intermediate-accounting-spiceland-7th-edition.pdf
- http://uncpbisdegree.com/1/that-summer-lauren-willig.pdf
- http://uncpbisdegree.com/1/service-manual-fellowes-mars-a4.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
- https://go.microsoft.com/fwlink/?linkid=868922
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
- http://go.microsoft.com/fwlink/?LinkID=617297
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003645.bin` `ca4fffedc8dda77a0f6301c9a82745fef5637a1644ee3d38374658568acf201b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3645	10344 bytes
`font_01_sfnt_off0000570f.bin` `e31143bac890fd2bc7ca18b9764611373f2f5acca6c59bc5d19d58d4eff82d91`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x570F	7404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.