Malicious PDF — malware analysis report

Static analysis result for SHA-256 7885a84ef6149da8…

MALICIOUS

PDF

33.4 KB Created: 2018-06-11 08:17:24 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2020-08-25
MD5: 28d38f9a5fca87489a75e20c9a7c6b04 SHA-1: 95182773705d5515c778495c7f9ed0b4ad2b8916 SHA-256: 7885a84ef6149da8f0a8f0682639ca90308002e58784efba5a5dde80a2eaa8e5
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains heuristics indicating it is a fake download lure, specifically designed for SEO poisoning. The embedded URLs point to a domain that is likely hosting a malicious payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9165

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=the-infidel-stain.pdf PDF link annotation
    • http://uncpbisdegree.com/download4.php?q=the-infidel-stain.pdfIn PDF document text
    • http://ministry127.com/resources/illustrations/graceIn PDF document text
    • http://www.ratsnakefoundation.org/2015/2015_honda_cbr125r_owners_manual.pdfIn PDF document text
    • http://www.sjparris.com/article.php?t=theIn PDF document text
    • http://www.enhancemyvocabulary.com/synonyms.htmlIn PDF document text
    • http://zompist.com/arabic.htmlIn PDF document text
    • http://salem-news.com/articles/october022009/hanoi_john_10-2-09.phpIn PDF document text
    • http://catallaxyfiles.com/2018/02/15/lets-recriminalise-adultery/In PDF document text
    • http://www.sermonnotebook.org/romans/RomIn PDF document text
    • http://www.mofak.com/gunny_bush.htmIn PDF document text
    • http://positivewordsresearch.com/list-of-negative-words/In PDF document text
    • http://www.jesus-is-savior.com/GreatIn PDF document text
    • http://ourladysresistance.org/index.htmlIn PDF document text
    • http://mashumba.com/english_shona1410.aspxIn PDF document text
    • http://smriti.com/urdu/urdu.dictionary.htmlIn PDF document text
    • http://www.khamush.com/divani_shams.htmIn PDF document text
    • http://riverside-resort.net/1/what-is-the-what.pdfIn PDF document text
    • http://riverside-resort.net/1/vw-polo-2018-owners-manuel.pdfIn PDF document text
    • http://riverside-resort.net/1/whats-a-century.pdfIn PDF document text
    • http://riverside-resort.net/1/waec-answers-to-chemistry-practical-alternative-b.pdfIn PDF document text
    • http://uncpbisdegree.com/1/solution-manual-ken-martin.pdfIn PDF document text
    • http://riverside-resort.net/1/what-is-grade12-2018-economics-paper2-final-scope.pdfIn PDF document text
    • http://riverside-resort.net/1/waac-answer-on-economics.pdfIn PDF document text
    • http://uncpbisdegree.com/1/stryker-1188-manual.pdfIn PDF document text
    • http://riverside-resort.net/1/volvo-v40-anchor-points-diagram.pdfIn PDF document text
    • http://riverside-resort.net/1/uss-theodore-roosevelt.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.thesaurus.com/browse/profaneIn PDF document text
    • http://www.constitution.org/tp/afri.htmIn PDF document text
    • http://www.benchmade.com/griptilian-family.htmlIn PDF document text
    • http://tvtropes.org/pmwiki/pmwiki.php/Characters/AstroCityIn PDF document text
    • http://www.newadvent.org/cathen/i.htmIn PDF document text
    • http://www.newadvent.org/cathen/In PDF document text
    • http://www.wowhead.com/quest=25333/might-of-the-sentinelsIn PDF document text
    • https://en.wikipedia.org/wiki/Circassian_beautiesIn PDF document text
    • http://www.newadvent.org/cathen/01181a.htmIn PDF document text
    • http://www.newadvent.org/cathenIn PDF document text
    • http://www.newadvent.org/cathen/a.htmIn PDF document text
    • http://www.nybooks.com/articles/2016/04/07/brilliant-troubled-dorothy-parker/In PDF document text
    • http://www.pbs.org/godinamerica/god-in-the-white-house/In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000049ae.bin
049a718014f58b4ca6bc720829332ac05b0f70e7bd073ad3e907ca4271dee631
pdf-font-stream PDF embedded font (sfnt) at offset 0x49AE 9736 bytes
font_01_sfnt_off000068c4.bin
cc01c8088396eb0e121d728d4d4b09da40288e7b9de9407f69617e051ce6fd5a
pdf-font-stream PDF embedded font (sfnt) at offset 0x68C4 6596 bytes