Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d27a05ea029b734…

MALICIOUS

PDF

31.3 KB Created: 2018-06-11 09:38:36 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 3580e593f5b5e02febca7ac02454b5bb SHA-1: 418cd7408d52fdbb3c8eb984c369f6af1cd8ab37 SHA-256: 5d27a05ea029b7349b5448856905ea1644b7dab86129e27fb54073005392a431
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains heuristics indicating it is a fake download lure, specifically using SEO poisoning to attract users searching for an operating manual. The embedded URLs point to suspicious domains, suggesting the document's primary purpose is to redirect users to download potentially malicious content. No scripts were extracted, but the overall pattern strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9577

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=servo-ventilator-300a-operating-manual.pdf
    • http://uncpbisdegree.com/download4.php?q=servo-ventilator-300a-operating-manual.pdf
    • http://www.berner-ross.ru/uploads/files/Cat_Hum.pdf
    • http://www.technimed.ca/files/Technimed-Medical-Battery-Catalog-Feb08.xls.xla
    • http://www.msckobe.com/parts/pn.htm
    • http://www.readbag.com/un-depts-oip-dp-dp5-02-04
    • http://riverside-resort.net/1/voices-of-the-faithful-kim-p-davis.pdf
    • http://uncpbisdegree.com/1/subaru-flat-rate-labor-guide.pdf
    • http://riverside-resort.net/1/vacuum-hose-routing-diagram-1996-jeep-grand-cherokee.pdf
    • http://uncpbisdegree.com/1/telecommunication-policy-journal.pdf
    • http://riverside-resort.net/1/unemployment-in-france.pdf
    • http://riverside-resort.net/1/veterans-hospital-danville-il.pdf
    • http://riverside-resort.net/1/wiring-diagram-for-boat-trailers.pdf
    • http://uncpbisdegree.com/1/steam-turbine-book.pdf
    • http://uncpbisdegree.com/1/siemens-commobility-intelligent-parking-solutions.pdf
    • http://riverside-resort.net/1/waec-physic-essay-answer-2014.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://www.manualslib.com/manual/1294304/Dr-Ger-Infinity-Delta.html
    • https://www.manualslib.com/brand/dr-ger/medical-equipment.html
    • https://www.manualslib.com/products/Dr-Ger-Infinity-Delta-8761862.html
    • https://view.officeapps.live.com/op/view.aspx?src=http%3A%2F%2Fwww.technimed.ca%2Ffiles%2FTechnimed-Medical-Battery-Catalog-Feb08.xls.xla
    • http://blog.naver.com/PostView.nhn?blogId=skyu0021&logNo=220513195721
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=KO_EN&a=http%3a%2f%2fblog.naver.com%2fPostView.nhn%3fblogId%3dskyu0021%26logNo%3d220513195721
    • https://y.qq.com/
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=ZH-CHS_EN&a=https%3a%2f%2fy.qq.com%2f
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d97.bin
6182864973bb3df0ffa451a78e57e455afae66432a088a14b8065dd2877b6a4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D97 10680 bytes
font_01_sfnt_off00005f5a.bin
978183dd2f4a831593118b5e6a6df142219bc923f175c3af9b7f50cdeecfea1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F5A 7564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.