PDF malware analysis — malicious · 5b9d572b0f73f775

MALICIOUS

PDF

36.1 KB Created: 2018-06-11 09:02:49 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)

MD5: ae168a3973ca353c4e6dd82535077011 SHA-1: a43007f422d91ed7dafcb46521b8489a0853673b SHA-256: 5b9d572b0f73f775e61d0336081af6d67214e157ac1f4be7eef05f54441e204a

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains heuristics indicating it is a fake download lure, specifically using SEO poisoning to attract users searching for 'strategic healthcare solutions'. The document body and extracted URLs point to a malicious domain, uncpbisdegree.com, which likely serves a malicious payload. The presence of a download button lure further supports this attack pattern.

Machine Learning

Nyx PDF Classifier malicious score 0.8781

Heuristics 4

Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD

The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://uncpbisdegree.com/download3.php?q=strategic-healthcare-solutions.pdf
- http://uncpbisdegree.com/download4.php?q=strategic-healthcare-solutions.pdf
- https://medicushcs.com/
- http://shpdata.com/
- http://www.navinet.net/solutions
- http://hdplus.com/
- http://www.siriuscom.com/solutions/healthcare/
- http://strattalent.com/
- http://trghealthcare.com/
- http://www.highpointsolutions.com/healthcare/
- http://spsinc.net/
- http://bhmpc.com/
- https://healthcare.lgcns.com/
- http://strategicinterests.com/
- https://www.galenhealthcare.com/
- http://www.midasplus.com/
- http://www.healthcareitconnect.com/2017-state-healthcare-it-connect-summit/
- http://www.strategicstaff.com/company-overview/
- https://gebbs.com/
- https://www.accumen.com/
- https://www.devero.com/
- https://strategichealthcare.net/
- http://www.strategichcs.com/services.html
- https://strategichs.com/
- https://strategichs.com/about-us/
- http://riverside-resort.net/1/toshiba-thrive-user-manual-download.pdf
- http://riverside-resort.net/1/the-name-of-the-star-a-shades-of-london-novel.pdf
- http://riverside-resort.net/1/segment-one-review-and-practice-test.pdf
- http://riverside-resort.net/1/slp-report-templates.pdf
- http://riverside-resort.net/1/silas-marner-the-weaver-of-raveloe-1st-new-edition.pdf
- http://riverside-resort.net/1/the-impact-equation-are-you-making-things-happen-or-just-noise-chris-brogan.pdf
- http://riverside-resort.net/1/textbook-rental-uw.pdf
- http://riverside-resort.net/1/sylvania-ssr90v4-dvd-players-owners-manual.pdf
- http://riverside-resort.net/1/the-esoteric-value-of-numbers-and-money.pdf
- http://riverside-resort.net/1/trials-2018-papers-basic.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://www.changehealthcare.com/provider-solutions
- https://www.hubbell.com/hubbellhealthcaresolutions/en
- http://www.johnsoncontrols.com/buildings/solutions-by-industry/healthcare
- https://www.hhs.gov/about/strategic-plan/strategic-goal-1/index.html
- https://www.hhs.gov/about
- https://www.hhs.gov/about/strategic-plan
- https://www.zebra.com/us/en/solutions/healthcare.html
- https://www.nextgen.com/
- https://www.changehealthcare.com/healthcare-data-analytics-solutions
- https://www.transunion.com/industry/healthcare
- http://www.level3.com/en/industries/healthcare/
- http://www.ironmountain.com/industries/healthcare-services/digital-transformation
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
+5 more URL(s)

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000504c.bin` `b16de16b8dec8a2dad497aa13922cbee0e3741baa5953f4539192fecbf34831b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x504C	10444 bytes
`font_01_sfnt_off0000717b.bin` `6a2d7ea79db2fd18279170e4856d2fa46cd6d70b383f97416b56c50d8dd90625`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x717B	7080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.