Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a606b942f727ec9…

MALICIOUS

PDF

35.3 KB Created: 2018-06-11 09:12:01 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: e3c676ea4dd5e3907017057d6ae46a4e SHA-1: b5759748eca5400a6fed1c5c7f92f9c39f6ca8dc SHA-256: 1a606b942f727ec958509a538bd5368995d4de11e9a3d72dc0d539bb47dd90fc
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution T1059.007 JavaScript

The PDF file contains heuristics indicating it is a fake download lure, specifically using SEO poisoning to attract users. It embeds external URIs pointing to download URLs on 'uncpbisdegree.com', which is highly suspicious. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to deliver a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8977

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-gardeners-son.pdf
    • http://uncpbisdegree.com/download4.php?q=the-gardeners-son.pdf
    • http://www.landscape-gardeners-rms.co.uk/
    • https://conwayandson.co.uk/
    • http://theorganicgardeners.com/
    • http://www.vmga.net/
    • http://upstategardenersjournal.com/
    • http://thegracefulgardener.com/?p=2854
    • http://www.chigiy.com/the_gardeners_anonymous_b/2007/01/to_kill_a_gophe.html
    • https://blog.fantasticgardeners.co.uk/europe-national-flowers/
    • https://blog.fantasticgardeners.co.uk/category/gardenpedia/
    • http://northtexasvegetablegardeners.com/forum/index.php?topic=271.0
    • http://www.henryarmer.com/
    • http://stspyridon.org.au/
    • http://www.egreenway.com/months/summer.htm
    • https://www.atmandsonlandscaping.co.uk/
    • http://www.averagepersongardening.com/
    • http://www.dgbanham.co.uk/
    • http://www.mammothonion.co.uk/
    • http://www.rynoskin.com/
    • http://riverside-resort.net/1/wiring-diagram-for-harley-davidson-softail-ignition.pdf
    • http://riverside-resort.net/1/varcarolis-foundations-of-psychiatric-mental-health-nursing.pdf
    • http://uncpbisdegree.com/1/seven-pin-wiring-diagram-trailers.pdf
    • http://riverside-resort.net/1/word-meaning-vocabulary.pdf
    • http://uncpbisdegree.com/1/supreme-order-in-the-court-worksheet-answers.pdf
    • http://riverside-resort.net/1/voltas-ac-remote-manual.pdf
    • http://uncpbisdegree.com/1/stihl-fs-440-manual.pdf
    • http://riverside-resort.net/1/us-education-scholarships-for-international-students.pdf
    • http://uncpbisdegree.com/1/smiths-grocery-coupons-printable.pdf
    • http://riverside-resort.net/1/unto-the-hills-a-daily-devotional.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://www.gardeners.com/how-to/growing-alliums/7371.html
    • https://en.wikipedia.org/wiki/Gardening
    • https://www.gardendesign.com/gifts-for-gardeners.html
    • http://www.dictionary.com/browse/gardener
    • https://en.wikipedia.org/wiki/Monty_Don
    • http://www.dailymail.co.uk/home/gardening/article-1339563/Millions-gardeners-banned-using-peat-protect-Britains-bogs.html
    • http://www.dailymail.co.uk/health/article-5246551/Study-reveals-best-posture-gardeners.html
    • https://www.tube8.com/mature/huge-tit-black-milf-is-fucked-hard-by-gardener%27s-bigdick-outdoors/2895431/
    • https://www.almanac.com/plant/strawberries
    • https://www.almanac.com/gardening
    • https://www.almanac.com/plants
    • https://www.xnxx.com/video-hjqu11b/mom_fucked_by_her_son_full_goo.gl_ugmxrx
    • http://www.latimes.com/home/la-hm-erskine-column-20180210-story.html
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    +1 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000500a.bin
19d5746c796a020b235320fb4f15d83fb061abb9918dddde198bfafaa460f494		 pdf-font-stream PDF embedded font (sfnt) at offset 0x500A 9736 bytes
font_01_sfnt_off00006f24.bin
d25014a6157510cc2efb09816be7448053fbde45dc51a03b7deee43e9d09b0fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F24 6864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.