Malicious PDF — malware analysis report

Static analysis result for SHA-256 14728ac38e00751d…

MALICIOUS

PDF

35.4 KB Created: 2018-06-11 09:07:10 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 94606aa785fba6ae38d5da6d74657735 SHA-1: cd2a2fb0bc1b6c2d6f08eb66b2b05cd369842632 SHA-256: 14728ac38e00751d142702a1cbcc06859bb8c901f28c4cea59eda3d8493bd950
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains heuristics indicating it is a fake download lure, specifically targeting users looking for textbook rentals. The embedded URLs point to a domain designed to serve malicious files, suggesting an attempt to trick users into downloading malware. The document body, though partially corrupted, contains references to textbook rentals and search engine query terms, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9062

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=textbook-rental-places.pdf
    • http://uncpbisdegree.com/download4.php?q=textbook-rental-places.pdf
    • http://www.slugbooks.com/
    • https://www.textbookrush.com/
    • http://www.barnesandnobleinc.com/news/
    • http://www.mymoneyblog.com/valore-books-review-textbook-sellback-experience.html
    • https://www.lizmarieblog.com/2015/07/decorate-rental/
    • https://www.propertyinvestmentproject.co.uk/blog/calculating-which-property-is-the-wiser-investment/
    • https://www.propertyinvestmentproject.co.uk/blog/buying-property-tips/
    • http://webgerman.com/germlinks/
    • http://premieroceanfrontrentals.com/
    • http://uncpbisdegree.com/1/textbook-rental-austin-tx.pdf
    • http://uncpbisdegree.com/1/the-economics-of-globalization-policy-perspectives-from-public-economics.pdf
    • http://riverside-resort.net/1/where-are-jews-from.pdf
    • http://riverside-resort.net/1/valve-application-guide.pdf
    • http://riverside-resort.net/1/virtual-reality-driving-lessons.pdf
    • http://riverside-resort.net/1/world-war-ii-aircraft.pdf
    • http://uncpbisdegree.com/1/solutions-a-first-course-on-atmospheric-thermodynamics.pdf
    • http://uncpbisdegree.com/1/solution-focused-therapy-with-children.pdf
    • http://riverside-resort.net/1/yfm350fw-bigbear-service-manual.pdf
    • http://uncpbisdegree.com/1/sue-o-de-ranita.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.toptenreviews.com/services/education/best-textbook-rentals-online/
    • https://en.wikipedia.org/wiki/Textbook
    • https://www.usnews.com/news/articles/2012/08/28/how-your-textbook-dollars-are-divvied-up
    • http://www.chegg.com/homework-help/a-first-course-in-probability-8th-edition-solutions-9780136033134
    • http://www.chegg.com/homework-help/questions-and-answers/use-midpoint-rule-given-value-n-approximate-integral-round-answer-four-decimal-places-64-s-q5106930
    • http://www.mlive.com/news/ann-arbor/index.ssf/2018/02/wcc_saves_students_27_million.html
    • https://en.wikipedia.org/wiki/Economics
    • https://www.amazon.com/Marketing-Management-Student-Value-15th/dp/0134236939
    • https://www.amazon.com/books-used-books-textbooks/b?ie=UTF8&node=283155
    • https://www.amazon.com/Business-Money-Investing-Books/b?ie=UTF8&node=3
    • https://www.amazon.com/Marketing-Sales-Business-Investing-Books/b?ie=UTF8&node=2698
    • https://www.zillow.com/blog/rental-property-depreciation-144131/
    • https://www.amazon.com/Artificial-Intelligence-Modern-Approach-3rd/dp/0136042597
    • https://www.amazon.com/Computers-Technology-Books/b?ie=UTF8&node=5
    • https://www.amazon.com/Computer-Science-Computers-Internet-Books/b?ie=UTF8&node=3508
    • http://soe.unc.edu/resources/technology/support/learn/index.php
    • http://www.travelandleisure.com/articles/the-50-most-romantic-places-on-earth
    • https://www.nps.gov/nr/travel/louisiana/text.htm
    • https://www.telegraph.co.uk/property/
    • https://www.forbes.com/sites/susanadams/2015/01/30/the-10-best-websites-for-finding-an-internship/
    • https://www.lonelyplanet.com/denmark
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e9a.bin
f108bd85e33534982601abd626c8bf9c769d69660b7aa23d7fd5e213f2e54571
pdf-font-stream PDF embedded font (sfnt) at offset 0x4E9A 10344 bytes
font_01_sfnt_off00006f89.bin
141cc3c9cf055d88de52d8aa2586e17abde8a447ba72673087aa159604983897
pdf-font-stream PDF embedded font (sfnt) at offset 0x6F89 6916 bytes