Malicious PDF — malware analysis report

Static analysis result for SHA-256 171e0cb7f7abe274…

MALICIOUS

PDF

34.3 KB Created: 2018-06-11 09:32:34 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: fee30fb34e32add415901de9b99ae75f SHA-1: 8eda7d30484f53426b265123cc8d232915555f51 SHA-256: 171e0cb7f7abe2742d0cec02135b8a93de4c370d3ca14d4495a620b4c9a3b61c
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier and a specific heuristic for SEO poisoning and fake downloads. It contains embedded URLs that redirect to a suspicious domain, likely intended to trick users into downloading malware disguised as a book. The document body also contains these malicious URLs, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8778

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-red-badge-of-courage-and-other-stories-stephen-crane.pdf
    • http://uncpbisdegree.com/download4.php?q=the-red-badge-of-courage-and-other-stories-stephen-crane.pdf
    • http://www.123helpme.com/search.asp?text=The+Red+Badge+of+Courage
    • http://www.planetpublish.com/free-ebooks/183/the-red-badge-of-courage/
    • http://www.123helpme.com/search.asp?text=The+Red+Wheelbarrow
    • http://www.theliterarymaven.com/2016/05/short-stories-high-school-middle-school.html
    • http://www.sealtwo.org/page23.htm
    • http://www.thrall.org/literature/
    • http://riverside-resort.net/1/the-theology-of-the-book-of-genesis-old-testament-theology.pdf
    • http://riverside-resort.net/1/the-champion-mills-boon-love-inspired-historical.pdf
    • http://riverside-resort.net/1/standard-web-resolution-2011.pdf
    • http://riverside-resort.net/1/the-prehistoric-archaeology-of-ireland.pdf
    • http://riverside-resort.net/1/the-best-of-everything-football-book.pdf
    • http://riverside-resort.net/1/street-rod-wiring-diagram.pdf
    • http://riverside-resort.net/1/the-stockholm-county-medical-information-system.pdf
    • http://riverside-resort.net/1/the-armageddon-trade.pdf
    • http://riverside-resort.net/1/the-catboat-era-in-newport-rhode-island.pdf
    • http://riverside-resort.net/1/solution-manual-federal-taxation-2013-pope-anderson.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://en.wikipedia.org/wiki/The_Red_Badge_of_Courage
    • https://www.barnesandnoble.com/w/the-red-badge-of-courage-stephen-crane/1116640337
    • https://www.britannica.com/topic/The-Red-Badge-of-Courage-novel-by-Crane
    • http://www.online-literature.com/crane/
    • https://www.litcharts.com/lit/the-red-badge-of-courage
    • http://www.sparknotes.com/lit/redbadge/section6/
    • https://en.wikipedia.org/wiki/Red
    • https://it.wikipedia.org/wiki/Stephen_Crane
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=IT_EN&a=https%3a%2f%2fit.wikipedia.org%2fwiki%2fStephen_Crane
    • http://www.online-literature.com/crane/2544/
    • https://americanliterature.com/author/stephen-crane/short-story/a-dark-brown-dog
    • https://americanliterature.com/short-stories
    • https://www.artofmanliness.com/articles/100-must-read-books-the-essential-mans-library/
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ac3.bin
a72b71dd0f73ee14975e49432f060e4538a6c38e59a990738764e3fa0c1c38be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4AC3 9964 bytes
font_01_sfnt_off00006a8f.bin
765872ac9799297b9309ffef6417f9b3181ec5b055a22c4167747169480d98d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6A8F 7320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.