Malicious PDF — malware analysis report

Static analysis result for SHA-256 52544c9e8d118509…

MALICIOUS

PDF

58.5 KB Created: 2018-06-11 09:08:32 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2020-09-04
MD5: 8494a6a7c722af0f98ba7c2ec623b390 SHA-1: 09b7d9dfe0c892cbb7ca0b9f7b981103260c3700 SHA-256: 52544c9e8d11850970eadfcaeea4d1cd7b7a127d203d19650291d966b03e619c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains multiple embedded URLs, with at least one pointing to a raw IP address, which is a common tactic for hosting malicious payloads. The presence of a 'download button' heuristic further suggests an attempt to trick the user into downloading a file. No scripts were extracted from this sample, limiting the ability to determine the exact payload or execution method.

Machine Learning

  • Nyx PDF Classifier clean score 0.0289

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=siemens-dx800a-telephones-owners-manual.pdf In PDF document text
    • http://uncpbisdegree.com/download4.php?q=siemens-dx800a-telephones-owners-manual.pdfIn PDF document text
    • http://www.frederickcomputers.com/reads-online/siemens-dx800a-telephones-owners-manual.pdfIn PDF document text
    • http://convair.de/siemens/dx800a/siemens_dx800a_telephones_owners_manual.pdfIn PDF document text
    • http://drabbi.de/siemens/dx800a/siemens_dx800a_telephones_owners_manual.pdfIn PDF document text
    • http://agebau.de/siemens/dx800a/siemens_dx800a_telephones_owners_manual.pdfIn PDF document text
    • http://www.psychoanaliza.org/si/dx/siemens-dx800a-telephones-owners-manual.pdfIn PDF document text
    • http://206.189.92.189/file-pdf/siemens-dx800a-telephones-owners-manual.pdfPDF link annotation
    • http://www.architect-wiki.com/reads-online/siemens-dx800a-telephones-owners-manual.pdfIn PDF document text
    • http://scan2000.de/si/dx800a_580/siemens_dx800a_telephones_owners_manual.pdfIn PDF document text
    • http://www.westforkcamp.org/si/m2/siemens-m2-professional-telephones-owners-manual.pdfIn PDF document text
    • http://uncpbisdegree.com/1/soundstream-600d-car-amplifiers-owners-manual.pdfIn PDF document text
    • http://uncpbisdegree.com/1/susana-y-javier-chapter-summaries.pdfIn PDF document text
    • http://uncpbisdegree.com/1/the-breakfast-club.pdfIn PDF document text
    • http://riverside-resort.net/1/wiring-diagram-for-air-compressor-pressure-switch.pdfIn PDF document text
    • http://uncpbisdegree.com/1/standards-gems-ukulele-ensembles-early-intermediate.pdfIn PDF document text
    • http://riverside-resort.net/1/user-guide-for-fanuc-6t.pdfIn PDF document text
    • http://uncpbisdegree.com/1/ssr-molecular-marker.pdfIn PDF document text
    • http://riverside-resort.net/1/wjec-mathamatics-higher-tier-june-2017-answers.pdfIn PDF document text
    • http://uncpbisdegree.com/1/six-grade-science-eog-review.pdfIn PDF document text
    • http://riverside-resort.net/1/wiring-diagram-mercedes-vito-2001.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://www.manualslib.com/products/Siemens-Gigaset-Dx800a-All-In-One-4260702.htmlIn PDF document text
    • https://www.manualslib.com/brand/In PDF document text
    • https://www.manualslib.com/brand/siemens/In PDF document text
    • https://www.manualslib.com/brand/siemens/telephone.htmlIn PDF document text
    • https://www.manualslib.com/manual/656118/Siemens-Gigaset-Dx800a.htmlIn PDF document text
    • https://www.manualslib.com/products/Siemens-Gigaset-Dx800a-All-In-One-3205420.htmlIn PDF document text
    • http://choice.microsoft.comIn PDF document text
    • https://0.r.bat.bing.com/?ld=d3G0oSvVddpLVEWNoDCCleETVUCUwKJ5dq4wvOeDac0zRNeh0c1QcJnoZw4oJuE4zBLDQeS2q-me4yipiO1Rp0dLi8R-csMbzN_nZ8YEIkW1YpIrXdldN5aEewI4GANdkENq1hL4mr0kItgMxcm9mryKdu740tNqaGNIjv8FxMLITRAb5W&u=http%3a%2f%2fwww.productmanuals.org%2flp%2f%3fbrand%3dSiemens%26utm_source%3dadcenter%26utm_medium%3dcpc%26utm_term%3dsiemens%2520repair%2520manual%26utm_network%3do%26utm_campaign%3dFM%2bMB%2b02-26In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617350In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://1195149.r.bat.bing.com/?ld=d3HOobF7FkfpqdT6U-_fROozVUCUw0WczaH7tkHtLeLONg-9BLFE3_gU5_XD0kFuxVNZMx3-QR6zUcdiAQtd8kmFucFamouzji7pUZNlr9yBJus5s9MXHBQ-AsUS9xSEsHV7MePyDqDuxW0bl-RYBDwvL6AhvWINnR6mAKsfXf2rpvYuBB&u=http%3a%2f%2ftracking.deepsearch.adlucent.com%2fadlucent%2fRedirector%3fretailer%3dadorama%26adl_channel%3dbingproductads%26adl_sku%3dSMNDX800A_0BMC%26adl_adType%3dPLA%26adl_adid%3d83700327633113%26adl_device%3dc%26adl_plaid%3d4587299952415303%26url%3dhttps%3a%2f%2ftracking.deepsearch.adlucent.com%2fadlucent%2fRedirector%3fretailer%3dadorama%26adl_channel%3dbingproductads%26adl_sku%3dSMNDX800A_0BMC%26adl_adType%3dPLA%26adl_adid%3d83700327633113%26adl_device%3dc%26adl_plaid%3d4587299952415303%26url%3dhttps%3a%2f%2fwww.adorama.com%2fSMNDX800A.html%3frefby%3dadl-umbase%26msclkid%3d%7bmsclkid%7d%26utm_source%3dbing%26utm_medium%3dcpc%26utm_campaign%3d%255BSHOPPING%255D%2520%255BADL%255D%2520%255BPLA%255D%2520-%2520Manufacturer%26utm_term%3d4587299952415303%26utm_content%3d%255BPLA%255D%2520-%2520ManufacturerIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000095ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x95AC 13864 bytes
SHA-256: 47000e3b43d11faf4b2b47a2cbda67329aa42ab3fbcf6ecc735d55d220aff66d
font_01_sfnt_off0000c073.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC073 9768 bytes
SHA-256: b22adbca39d7e1c48d14a60f48a6dddf28a7f214fc47a877689a757fe0faacd6

Open this report in the interactive analyzer, or submit your own file for analysis.