Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e854d8b84977b3d…

MALICIOUS

PDF

49.7 KB Created: 2018-06-11 09:41:51 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: fad3757fa4a336f7aeeb2d8281a92a61 SHA-1: e367471faa5d82dc399e4e5dbb0a3de3bf900666 SHA-256: 6e854d8b84977b3d56f54a99139543259c22ba0664882fa9826e1c71115cb547
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass of external links, many of which are disguised as download links for a document titled 'women laws and judicial pronouncements'. Heuristics indicate this is a fake download SEO-poisoning tactic. The primary malicious URLs are part of a link farm designed to trick users into downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9023

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=women-laws-and-judicial-pronouncements.pdf
    • http://uncpbisdegree.com/download4.php?q=women-laws-and-judicial-pronouncements.pdf
    • http://www.createdtobehis.com/file/women-laws-and-judicial-pronouncements.pdf
    • http://churchwebtv.com/file/women-laws-and-judicial-pronouncements.pdf
    • http://riekko.de/women/laws/women_laws_and_judicial_pronouncements.pdf
    • https://www.popline.org/node/303419
    • http://mja.gov.in/Site/Upload/GR/Workshop_280215_Civil.pdf
    • http://www.legalserviceindia.com/legal/article-116-judicial-activism-in-protection-and-promotion-of-women-in-india-with-special-reference-to-indian-constitution.html
    • http://jlsr.thelawbrigade.com/wp-content/uploads/2016/11/Dharminder.pdf
    • http://riverside-resort.net/1/your-checking-account-packet-answers.pdf
    • http://riverside-resort.net/1/using-venn-diagrams-problems-independent-practice.pdf
    • http://uncpbisdegree.com/1/sujetos-sociales-y-politicas.pdf
    • http://uncpbisdegree.com/1/study-guide-and-solutions-manual.pdf
    • http://uncpbisdegree.com/1/service-and-technical-support-manual-tradeia.pdf
    • http://uncpbisdegree.com/1/the-all-purpose-science-teacher-national-council-on.pdf
    • http://riverside-resort.net/1/what-money-cant-buy-the-moral-limits-of-markets-michael-j-sandel.pdf
    • http://riverside-resort.net/1/wave-velocity-calculations-worksheet-answers.pdf
    • http://riverside-resort.net/1/with-r-influenced-words.pdf
    • http://riverside-resort.net/1/war-against-the-americans-resistance-and-collaboration-in-cebu-1899-1906.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.worldcat.org/title/women-laws-and-judicial-pronouncements/oclc/424450971
    • https://www.amazon.com/Women-Judicial-Pronouncements-Jessy-Kurian/dp/8189762303
    • https://blog.ipleaders.in/triple-talaq/
    • https://blog.ipleaders.in/category/general/
    • https://blog.ipleaders.in/multi-level-marketing/
    • https://quizlet.com/18909177/business-law-quiz-1-flash-cards/
    • http://go.microsoft.com/fwlink/?LinkID=617350
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297
    • https://www.amazon.com/Women-Judicial-Pronouncements-Jessy-Kurian/
    • https://quizlet.com/18909177/business-law-quiz-1-flash-cards
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000736c.bin
82b5ec3bb738fd578c57a4f99bf2823dfbe43a82276bdaac37d0883519e030d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x736C 14912 bytes
font_01_sfnt_off0000a0b0.bin
534de24179e79921bb1bf3496932fa36f7aa05077eb3b0838caa2638c26a14cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA0B0 9128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.