Malicious PDF — malware analysis report

Static analysis result for SHA-256 2536d69cc6e0eda6…

MALICIOUS

PDF

30.1 KB Created: 2018-06-11 08:30:44 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: ee384e374dd89a96fdd4a786d257e6f9 SHA-1: 914c3a7a9a209a42c414cd680fbf87ec0299f04b SHA-256: 2536d69cc6e0eda60d7010e2311c48b77812a71cb51a12034bda4930f376b117
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by an ML classifier and contains heuristics indicating it is a fake download lure. The document body and embedded URLs point to 'uncpbisdegree.com', which is likely hosting a malicious payload disguised as an examination document. The presence of embedded URLs suggests an attempt to redirect the user to a download site, aligning with a spearphishing attachment tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9567

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=ss2-joint-examination-for-all-subject.pdf
    • http://uncpbisdegree.com/download4.php?q=ss2-joint-examination-for-all-subject.pdf
    • https://www.tc.gc.ca/eng/civilaviation/publications/tp13312-2-menu-2331.htm
    • http://www.assembly.nl.ca/legislation/sr/statutes/e05-1.htm
    • http://www.regionalstudies.org/conferences/special-sessions/special-sessions-lugano
    • https://www.52ml.net/22336.html
    • http://riverside-resort.net/1/tacoma-trailer-wiring-harness.pdf
    • http://riverside-resort.net/1/service-manual-daewoo-evanda.pdf
    • http://riverside-resort.net/1/the-mortal-religion-a-dark-disturbing-psychological-thriller.pdf
    • http://riverside-resort.net/1/the-last-food-of-england.pdf
    • http://riverside-resort.net/1/sisas-implementing-cisco-secure-access-solutions.pdf
    • http://riverside-resort.net/1/the-ramp-and-friction-phet-simulation-lab.pdf
    • http://riverside-resort.net/1/the-dube-train-grade11-notes.pdf
    • http://riverside-resort.net/1/shark-attack-dk-readers.pdf
    • http://riverside-resort.net/1/the-visual-food-encyclopedia-the-definitive-practical-guide-to-food-and-cooking.pdf
    • http://riverside-resort.net/1/trane-xe90-led-codes.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://en.wikipedia.org/wiki/Education_in_nigeria
    • http://dx.doi.org/
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=ZH-CHS_EN&a=https%3a%2f%2fwww.52ml.net%2f22336.html
    • http://www.who.int/medical_devices/innovation/GMDN_PresentationWHO.ppt?ua=1
    • https://view.officeapps.live.com/op/view.aspx?src=http%3A%2F%2Fwww.who.int%2Fmedical_devices%2Finnovation%2FGMDN_PresentationWHO.ppt%3Fua%3D1
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b16.bin
42260714a586529fa490267ce024d6987852f2501f5c0f7cc7926026565d53ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B16 10076 bytes
font_01_sfnt_off00005b25.bin
46e59beb8e324f407ffa8f151bc929ac6877491beea0e0ab697737dcf7f707c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B25 7360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.