Malicious PDF — malware analysis report

Static analysis result for SHA-256 6866ccb23277ff26…

MALICIOUS

PDF

34.7 KB Created: 2018-06-11 08:45:06 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: a30a318e486be2b08f07dfc3463a788d SHA-1: a60dcb12c91e31e23c929c2096776220268830ff SHA-256: 6866ccb23277ff26666471644a230d29e32bdf55979217a000b369569b3ebf9a
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The sample is a PDF file identified as malicious by an ML classifier. It contains embedded URLs and a heuristic firing for 'PDF_SEO_FAKE_DOWNLOAD', indicating it's designed to trick users into downloading malware. The document body, though partially garbled, contains references to the malicious URLs, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9340

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-wrecker-isaac-bell-2-clive-cussler.pdf
    • http://uncpbisdegree.com/download4.php?q=the-wrecker-isaac-bell-2-clive-cussler.pdf
    • https://www.clive-cussler-books.com/wp-content/uploads/2016/05/Clive-Cussler-Novels-Chronological-Reading-List.pdf
    • https://mysterysequels.com/clive-cussler-books-in-order
    • https://www.bookseriesinorder.com/clive-cussler/
    • https://www.bookseriesinorder.com/authors/
    • https://www.bestaudiobooksandebooks.com/products/62-audiobooks-clive-cussler-mp3-unabridged-complete-mp3-collection-set-series
    • http://www.boekbeschrijvingen.nl/cussler-clive/cussler2.html
    • https://www.google.co.in/
    • http://riverside-resort.net/1/thermo-king-preventive-maintenance-training-manual.pdf
    • http://riverside-resort.net/1/topographie-der-leiharbeit.pdf
    • http://riverside-resort.net/1/statistics-question-barisal-board-2018.pdf
    • http://riverside-resort.net/1/the-necessary-hunger-a-novel.pdf
    • http://riverside-resort.net/1/udk-documentation.pdf
    • http://riverside-resort.net/1/tea-with-emma-the-teacup-novellas-1-diane-moody.pdf
    • http://riverside-resort.net/1/stanton-c-502-cd-players-owners-manual.pdf
    • http://riverside-resort.net/1/top-bananas-the-best-ever-family-recipes-from-mumsnet.pdf
    • http://riverside-resort.net/1/solution-manual-simon-haykin-neural-network.pdf
    • http://riverside-resort.net/1/staffing-solutions-phoenix-az.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://en.wikipedia.org/wiki/Clive_Cussler
    • https://www.barnesandnoble.com/w/the-cutthroat-clive-cussler/1123954291
    • https://it.wikipedia.org/wiki/Clive_Cussler
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=IT_EN&a=https%3a%2f%2fit.wikipedia.org%2fwiki%2fClive_Cussler
    • https://fr.wikipedia.org/wiki/Clive_Cussler
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=FR_EN&a=https%3a%2f%2ffr.wikipedia.org%2fwiki%2fClive_Cussler
    • https://pl.wikipedia.org/wiki/Clive_Cussler
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=PL_EN&a=https%3a%2f%2fpl.wikipedia.org%2fwiki%2fClive_Cussler
    • https://nl.wikipedia.org/wiki/Clive_Cussler
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=NL_EN&a=https%3a%2f%2fnl.wikipedia.org%2fwiki%2fClive_Cussler
    • https://de.wikipedia.org/wiki/Romane_von_Clive_Cussler
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=DE_EN&a=https%3a%2f%2fde.wikipedia.org%2fwiki%2fRomane_von_Clive_Cussler
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=NL_EN&a=http%3a%2f%2fwww.boekbeschrijvingen.nl%2fcussler-clive%2fcussler2.html
    • http://tvtropes.org/pmwiki/pmwiki.php/Main/SpotTheImposter
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://en.wikipedia.org/wiki/Dragon_
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b8a.bin
349a3ad96ace7f4e815311ba9448d3a6da109b47384563f536cdf4b08bf1afd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4B8A 10208 bytes
font_01_sfnt_off00006c0d.bin
beb8db05bbfb1484fa114f775d22d286cf248992dfa0b1cee547bcc443f702a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C0D 7312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.