Malicious PDF — malware analysis report

Static analysis result for SHA-256 7be9678e70cbfd06…

MALICIOUS

PDF

28.1 KB Created: 2018-06-11 09:50:41 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: 31b02a12885dbef1da75a799a0bf2935 SHA-1: 4a9cfdae7581284c7591b426be061ce521c74e34 SHA-256: 7be9678e70cbfd060f80034d9fcfbcce80c08fbb79de04ed2474bcdf39b9ae0e
70 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1059.001 PowerShell

The ClamAV heuristic identified this PDF as a dropper, and it contains multiple external URIs pointing to potentially malicious PDF files. The document body also contains a visual download lure, reinforcing the malicious intent. The primary attack vector appears to be tricking the user into downloading a malicious PDF from one of the provided URLs.

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-9273170-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9273170-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=sullivan-air-compressor-manual-ls10a-25hp.pdf
    • http://uncpbisdegree.com/download4.php?q=sullivan-air-compressor-manual-ls10a-25hp.pdf
    • http://uncpbisdegree.com/1/sports-car-with-hatchback.pdf
    • http://uncpbisdegree.com/1/the-big-policeman-the-rise-and-fall-of-thomas-byrnes-america-apos-s-first-most-rut.pdf
    • http://riverside-resort.net/1/who-was-charles-de-gaulle.pdf
    • http://uncpbisdegree.com/1/service-tax-rule-6-3.pdf
    • http://riverside-resort.net/1/verizon-iphone-manual-user-guide.pdf
    • http://uncpbisdegree.com/1/the-igbo-roots-of-olaudah-equiano-an-anthropological-research.pdf
    • http://uncpbisdegree.com/1/september-2018-paper-1-agricultural-sciences-memo.pdf
    • http://uncpbisdegree.com/1/the-cia-the-british-left-and-the-cold-war-calling-the-tune.pdf
    • http://uncpbisdegree.com/1/teachers-discovery-frankenstein-answers.pdf
    • http://riverside-resort.net/1/wiring-for-ford-taures-defogger.pdf
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003218.bin
5511109ab4339184e81bcc323c694c557b21644010c8417df42d876cb7993aec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3218 10764 bytes
font_01_sfnt_off0000540b.bin
297e1544f88ada0d428b18e95543123eb53a15161ba993a506c2069f9e01f731		 pdf-font-stream PDF embedded font (sfnt) at offset 0x540B 7396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.