Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a85524d23445e37…

MALICIOUS

PDF

33.3 KB Created: 2018-06-11 08:33:15 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 685df44fadb63f8fa6fdf6703208a9a9 SHA-1: 5f6b57618769b015db8abaa32ad591028a96dc02 SHA-256: 4a85524d23445e37ea3a8d0156ff98bc6424b09c1196483c211a0200503ac179
70 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1059.001 PowerShell

The PDF file contains embedded URLs and a heuristic firing indicating it is a dropper. The ClamAV detection 'Pdf.Dropper.Agent-9126103-0' strongly suggests malicious intent. The document body, though partially garbled, includes URLs that appear to be part of a lure, specifically referencing 'the golden almanac' and pointing to download scripts. The primary IOCs are the URLs associated with the download attempts.

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-9126103-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9126103-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-golden-almanac.pdf
    • http://uncpbisdegree.com/download4.php?q=the-golden-almanac.pdf
    • http://dmbalmanac.com/
    • http://netstate.com/states/intro/ca_intro.htm
    • http://www.gvinc.coop/
    • http://dma.wtw-x.net/
    • http://www.dmbalmanac.com/Songs.aspx
    • http://www.californiacityfinance.com/index.php
    • http://sfrecpark.org/parks-open-spaces/golden-gate-park-guide/
    • https://www.collegehockeynews.com/reports/team/Minnesota/34
    • http://www.jamaicanfamilysearch.com/Samples/AL40Ann.htm
    • http://riverside-resort.net/1/used-4x4-ford-expedition.pdf
    • http://uncpbisdegree.com/1/survival-guide-for-beginners.pdf
    • http://uncpbisdegree.com/1/solid-state-ionics-3rd-asian-conference.pdf
    • http://uncpbisdegree.com/1/solution-manual-of-heat-transfer.pdf
    • http://uncpbisdegree.com/1/skoda-octavia-eleganse-workshop-manual.pdf
    • http://uncpbisdegree.com/1/terapia-del-alma.pdf
    • http://riverside-resort.net/1/vocabulario-1-capitulo-answers.pdf
    • http://riverside-resort.net/1/virtual-human-dissection-games.pdf
    • http://uncpbisdegree.com/1/southern-fried-sushi-1-jennifer-rogers-spinola.pdf
    • http://uncpbisdegree.com/1/tet-question-with-answer-in-assamese.pdf
    • http://riverside-resort.n
    • https://en.wikipedia.org/wiki/Poor_Richard%27s_Almanack
    • https://www.almanac.com/pest/skunks
    • https://www.almanac.com/content/when-fathers-day
    • http://www.baseball-almanac.com/ws/yr1970ws.shtml
    • http://www.baseball-almanac.com/articles/uniforms-cubs.shtml
    • http://oldediscjockeysalmanac.blogspot.com/
    • https://www.cbsnews.com/news/almanac-the-donald-deskey-designer-of-radio-city-music-hall/
    • https://css-tricks.com/almanac/properties/a/appearance/
    • https://css-tricks.com/almanac/
    • https://css-tricks.com/almanac/properties/
    • https://css-tricks.com/almanac/properties/a/
    • http://www.energy.ca.gov/almanac/electricity_data/web_qfer/Annual_Generation-Plant_Unit.php
    • http://www.energy.ca.gov/almanac/
    • http://www.energy.ca.gov/almanac/electricity_data/
    • http://www.energy.ca.gov/almanac/electricity_data/web_qfer/
    • https://en.wikipedia.org/wiki/Islamic_Golden_Age
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047be.bin
1be2e2347e390994efa0dc7a5b7a648909fbaf421d82437fa1ead381a97d90b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47BE 10444 bytes
font_01_sfnt_off000068e4.bin
77e402037070f74addde5228b26d5a53d546bdfb6dceac454a52c7d5377cb830		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68E4 6572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.