Malicious PDF — malware analysis report

Static analysis result for SHA-256 17a6e3221bf48ccf…

MALICIOUS

PDF

30.7 KB Created: 2018-06-11 08:57:40 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: a9bf7e98797466bd8fa995a9c81772f9 SHA-1: 3cb526119a27ca81aff927cd62784c4494b0bc96 SHA-256: 17a6e3221bf48ccf08edeca7d806f34b20d7e26e8da533c281ea2e258e393633
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF was flagged by a machine learning classifier and a specific heuristic for SEO poisoning and fake download lures. The document body and extracted URLs point to a malicious gateway designed to trick users into downloading a file. The primary malicious URLs are http://uncpbisdegree.com/download3.php?q=the-rough-guide-to-bulgaria-rough-guide-travel-guides.pdf and http://uncpbisdegree.com/download4.php?q=the-rough-guide-to-bulgaria-rough-guide-travel-guides.pdf, which are likely serving the secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9577

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-rough-guide-to-bulgaria-rough-guide-travel-guides.pdf
    • http://uncpbisdegree.com/download4.php?q=the-rough-guide-to-bulgaria-rough-guide-travel-guides.pdf
    • https://foodfuntravel.com/merida-mexico-yucatan-guide/
    • http://www.ac6v.com/repeaters.htm
    • http://www.arrivalguides.com/en/Travelguides/Europe/Spain
    • https://www.thelongestwayhome.com/travel-resources/trekking/mount-everest-base-camp-trek-information.html
    • http://naughtynomad.com/2010/05/11/hanoi-city-guide-2/
    • https://www.evanscycles.com/buying-guides/adventure-road
    • http://naughtynomad.com/2013/11/28/city-guide-kingston-jamaica/
    • http://riverside-resort.net/1/vw-golf-gti-wire-diagram.pdf
    • http://uncpbisdegree.com/1/stihl-chainsaw-manuals-owners.pdf
    • http://riverside-resort.net/1/urban-forestry-and-urban-greening.pdf
    • http://uncpbisdegree.com/1/sql-server-cost-recovery-wardy-it-solutions.pdf
    • http://riverside-resort.net/1/when-the-walls-fell-out-of-time-2.pdf
    • http://riverside-resort.net/1/wiring-diagram-mazda6-electrical.pdf
    • http://uncpbisdegree.com/1/sponsorship-for-masters-degree.pdf
    • http://uncpbisdegree.com/1/suzuki-outboard-manual.pdf
    • http://uncpbisdegree.com/1/spanish-vocabulario-2-gramatica-2-answers.pdf
    • http://riverside-resort.net/1/waec-fishery-answer-2014.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://www.roughguides.com/shop/
    • https://www.lonelyplanet.com/
    • https://www.lonelyplanet.com/philippines
    • https://www.moneysavingexpert.com/travel/cheap-holiday-haggling-guide
    • https://www.seat61.com/Australia.htm
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d00.bin
efe6e773d7646136d721caaf1a0c6b2fa4e1997a4b71f705a13108dfa9555cb5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D00 10312 bytes
font_01_sfnt_off00005dc6.bin
1b751b42ee1e996a687aa4a6a5442a5be7cf60de6518650472be88a2a5acd0e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DC6 7320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.