Malicious PDF — malware analysis report

Static analysis result for SHA-256 68bfbb198766a166…

MALICIOUS

PDF

30.9 KB Created: 2018-06-11 08:56:19 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: e0f0c3adadd78948703081588f1668bb SHA-1: 97e400a411bf0755ecfc7d9ec0392bcaa2cc5c3d SHA-256: 68bfbb198766a1662da30372000df6b8cd6e8b506674c2bc0b7ed343f7646b08
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains heuristics indicating it is a fake download lure, specifically using SEO poisoning to trick users into downloading a malicious file. The embedded URLs point to a domain designed to serve malware, masquerading as a download for a technical book. No scripts were extracted, but the overall pattern suggests a phishing attempt to deliver a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9648

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-rootkit-arsenal-escape-and-evasion-in-dark-corners-of-system-bill-blunden.pdf
    • http://uncpbisdegree.com/download4.php?q=the-rootkit-arsenal-escape-and-evasion-in-dark-corners-of-system-bill-blunden.pdf
    • http://riverside-resort.net/1/where-is-banana-republic.pdf
    • http://riverside-resort.net/1/upward-panic-the-autobiography-of-eva-palmer-sikelianos-choreography-and-dance-series.pdf
    • http://riverside-resort.net/1/vector-poker-card-design.pdf
    • http://uncpbisdegree.com/1/the-dc-comics-guide-to-creating-comics-inside-the-art-of-visual-storytelling.pdf
    • http://riverside-resort.net/1/vao-model-question-paper-in-tamil.pdf
    • http://uncpbisdegree.com/1/skagen-463sgg-watches-owners-manual.pdf
    • http://uncpbisdegree.com/1/the-depression-book-depression-as-an-opportunity-for-spiritual-practice.pdf
    • http://riverside-resort.net/1/yamaha-ef6300isde-service-manual.pdf
    • http://riverside-resort.net/1/what-a-plant-knows-field-guide-to-the-senses-daniel-chamovitz.pdf
    • http://uncpbisdegree.com/1/teaching-resources-humans-biosphere-answer-key.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://en.wikipedia.org/wiki/Rootkit
    • https://fr.wikipedia.org/wiki/Rootkit
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=FR_EN&a=https%3a%2f%2ffr.wikipedia.org%2fwiki%2fRootkit
    • http://www.jblearning.com/catalog/disciplineProducts.aspx?disID=2115
    • https://ko.wikipedia.org/wiki/%EB%A3%A8%ED%8A%B8%ED%82%B7
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=KO_EN&a=https%3a%2f%2fko.wikipedia.org%2fwiki%2f%25EB%25A3%25A8%25ED%258A%25B8%25ED%2582%25B7
    • https://en.wikipedia.org/wiki/Microsoft_Windows_library_files
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003da3.bin
c7d45a3fe2382a421ed35402054471b275fea5a4683d26898fd47d75035e9a81		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3DA3 10592 bytes
font_01_sfnt_off00005f32.bin
81b5f44f9967e621b76451888e88c7b31d409fb2e18773f4ace208e19222cf7d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F32 7156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.