Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e08854ace62be27…

MALICIOUS

PDF

33.3 KB Created: 2018-06-11 09:56:44 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 20c55c3b825613e9ea0f0adf2473db3c SHA-1: a49c8d4ff416f20989d0ffb5313b85f8e66aea5f SHA-256: 2e08854ace62be271d71130542d234b987a1c85fa556649ba1310d66279b583c
72 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File

The file is identified as a PDF containing a lure for downloading a truck wiring diagram. The presence of a 'download button' heuristic and an external URI pointing to a .php file suggests a malicious download attempt. ClamAV detection further confirms its malicious nature. The document body, though partially garbled, contains references to download URLs and search queries related to truck wiring diagrams, reinforcing the lure.

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-9185604-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9185604-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=truck-wiring-diagrams-mitsubishi.pdf
    • http://uncpbisdegree.com/download4.php?q=truck-wiring-diagrams-mitsubishi.pdf
    • http://truck-expert.net/
    • http://www.autorepairmanuals.biz/product/STI427
    • https://www.auto-facts.org/automotive-wiring-diagrams/
    • https://www.automotive-manuals.net/isuzu/
    • http://truck-expert.net/s/manual.html
    • http://www.commandocaralarms.com/wiringsearch.asp
    • https://www.automotive-manuals.net/renault/
    • https://www.themanualstore.com/Boat-Manual-s/210.htm
    • http://www.malaysiaminilover.com/ford-alternator-wiring-diagram
    • http://www.autorepairmanuals.biz/
    • http://ricksfreeautorepairadvice.com/get-car-wiring-diagram/
    • https://www.eclipse-tech.co.uk/products/truck/jaltest-truck-package/
    • http://www.occupynewark.org/ni/ti/nissan-titan-radio-wiring-manuals.pdf
    • https://diesellaptops.com/TEXA-Dealer-Level-Truck-Diagnostic-Scanner-Tool-with-Laptop-TEXA-TRUCK-LAPTOP.htm
    • https://www.factoryrepairmanuals.com/2004-ford-lincoln-mercury-car-truck-powertrain-control-emissions-diagnosis-service-manual/
    • https://www.performancetrucks.net/forums/
    • http://riverside-resort.net/1/the-delphi-agenda-kindle-edition-rob-swigart.pdf
    • http://riverside-resort.net/1/the-last-kids-on-earth.pdf
    • http://riverside-resort.net/1/the-two-gentlemen-of-verona-the-oxford-shakespeare-oxford-worlds-classics.pdf
    • http://riverside-resort.net/1/the-house-of-lords-the-sessional-papers.pdf
    • http://riverside-resort.net/1/solution-fundamentals-of-abstract-algebra-malik-bing-2.pdf
    • http://riverside-resort.net/1/shop-vac-9520258-vacuums-owners-manual.pdf
    • http://riverside-resort.net/1/toda-mafalda-quino.pdf
    • http://riverside-resort.net/1/solution-focused-brief-therapy-certification.pdf
    • http://riverside-resort.net/1/surface-area-of-prisms-worksheet-answers.pdf
    • http://riverside-resort.net/1/the-ryder-cup-trivia-quiz-book-250-questions-on-the-history-of-the-golf-competition.pdf
    • http://riversid
    • http://www.motortrend.com/news/possible-ford-mustang-gt500-engine-drawings-leak/
    • http://www.motortrend.com/auto-news/
    • http://go.microsoft.com/fwlink/?LinkID=617350
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004566.bin
75446c4001be6ffe28baea170bc4919d2c21a8252535845c8fbce2d74c70a4b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4566 10488 bytes
font_01_sfnt_off000066a7.bin
9cdc17da8d200a9af83f9c60c7653484edd396bd9fa1ceec4b245b900678a22c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66A7 7456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.