Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ff3fa3cc9a614b7…

MALICIOUS

PDF

32.8 KB Created: 2018-06-11 09:19:14 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 7cf921aca4f90199098690117f5c89d1 SHA-1: 2fa9874e0db2b81849c603f56a172f7a9bd2d88d SHA-256: 2ff3fa3cc9a614b781bbfc4a97f7cdc4a0be9362c6aa67bdb952c218d626d62c
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains heuristics indicating it is a fake 'free download' SEO-poisoning document. It embeds URLs that mimic search results for academic materials, specifically a solution manual, to trick users into clicking. The primary malicious URL identified is http://uncpbisdegree.com/download3.php?q=wireless-communication-andrea-goldsmith-solution-manual-chapter-12.pdf, which likely serves as a gateway to a further payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9202

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=wireless-communication-andrea-goldsmith-solution-manual-chapter-12.pdf
    • http://uncpbisdegree.com/download4.php?q=wireless-communication-andrea-goldsmith-solution-manual-chapter-12.pdf
    • http://www.pageinsider.com/
    • http://www.ijera.com/pages/v3no4.html
    • https://1mbed.com/
    • http://www.critcononline.com/action.htm
    • http://riverside-resort.net/1/what-wildness-is-this-women-write-about-the-southwest.pdf
    • http://riverside-resort.net/1/visiting-card-design-for-home-appliances.pdf
    • http://uncpbisdegree.com/1/the-gods-of-greeks-karl-kerenyi.pdf
    • http://uncpbisdegree.com/1/the-amazing-spider-man-free-comic-book-day-2011.pdf
    • http://uncpbisdegree.com/1/student-council-interview-answers.pdf
    • http://uncpbisdegree.com/1/suzuki-baleno-engine-diagram-1995.pdf
    • http://uncpbisdegree.com/1/t-mobile-phone-repair-centers.pdf
    • http://uncpbisdegree.com/1/the-bingo-palace.pdf
    • http://uncpbisdegree.com/1/solution-manual-cyber-exploration.pdf
    • http://riverside-resort.net/1/yamaha-v-star-1300-deluxe-manual.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.facebook.com/photo.php
    • http://www.loot.co.za/index/html/index3385.html
    • http://www.loot.co.za/index/html/index231.html
    • https://www.nytimes.com/search
    • https://www.youtube.com/results
    • https://www.telegraph.co.uk/news/
    • http://music.163.com/
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=ZH-CHS_EN&a=http%3a%2f%2fmusic.163.com%2f
    • https://www.google.com/?gws_rd=ssl
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=FR_EN&a=https%3a%2f%2f1mbed.com%2f
    • http://theconversation.com/articles.atom
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000043e2.bin
7e52ba893dc3f5ab69fc797e7ae5eb3a9b76ab7a9f2a281ef0afb141865b223f
pdf-font-stream PDF embedded font (sfnt) at offset 0x43E2 10512 bytes
font_01_sfnt_off0000653e.bin
1be68246f7293d11cdac722b58d95681b31369a1a11e3c647fe7c8780fb5d9b9
pdf-font-stream PDF embedded font (sfnt) at offset 0x653E 7376 bytes