Malicious PDF — malware analysis report

Static analysis result for SHA-256 489d31d06c2427e2…

MALICIOUS

PDF

28.1 KB Created: 2018-06-11 09:39:32 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 65d595a4721a5e0ea6045b7d8a1433dd SHA-1: 9a97af7261e4a353449473731b33b5f0a9cb1f97 SHA-256: 489d31d06c2427e20f50358512f172f1886e3879b85cd2d2391f7019f2d04b0e
70 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The file is identified as a PDF dropper by ClamAV. It contains multiple embedded URLs, with the primary suspicious URL being http://uncpbisdegree.com/download3.php?q=structurix-film-dryer-service-manual.pdf. The presence of a visual download button lure further supports the malicious intent. The document body, though partially garbled, contains references to these suspicious URLs, indicating a likely attempt to trick the user into downloading further malicious content.

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-9144147-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9144147-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=structurix-film-dryer-service-manual.pdf
    • http://uncpbisdegree.com/download4.php?q=structurix-film-dryer-service-manual.pdf
    • http://www.readbag.com/jmtestsystems-2006-images-pdf-aml
    • http://riverside-resort.net/1/who-is-lebron-james.pdf
    • http://uncpbisdegree.com/1/sun-microsystems-365-1408-monitors-owners-manual.pdf
    • http://riverside-resort.net/1/volvo-v40-wiring-diagram-keyless-entry.pdf
    • http://uncpbisdegree.com/1/the-honest-life-living-naturally-and-true-to-you-jessica-alba.pdf
    • http://riverside-resort.net/1/virginia-drivers-education-workbook-answers.pdf
    • http://uncpbisdegree.com/1/term-paper-on-mechanical-engineering.pdf
    • http://uncpbisdegree.com/1/sociology-for-a2-aqa.pdf
    • http://riverside-resort.net/1/walter-benjamin-para-principiantes-pb-2001.pdf
    • http://riverside-resort.net/1/waec-may-june-2017-question-and-answer-for-visual-art.pdf
    • http://uncpbisdegree.com/1/solution-mechanics-of-materials-ugural.pdf
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003276.bin
ea18951163768f3e0f77edf81e578af6f9452e11c1ebee99dbad19919ed55d3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3276 11020 bytes
font_01_sfnt_off00005539.bin
2d7554d4dc6978bc96a43312086c8721fae1615eb29a142e58dd53184cf5932f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5539 6924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.