Malicious PDF — malware analysis report

Static analysis result for SHA-256 800b51b428f63bfc…

MALICIOUS

PDF

31.8 KB Created: 2018-06-11 09:11:11 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2020-08-10
MD5: 0feef3213bdfdd01b1153a80b6a6e932 SHA-1: ab76c2fd48ab7faf1fed20e146c4c9d9a2b1a9f5 SHA-256: 800b51b428f63bfce62e2fb426aee9f2c907ff2b1e319c8813f2965a46e2e846
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF is classified as malicious due to its use of SEO poisoning to lure users into downloading a fake free guitar book. The document contains embedded links pointing to suspicious URLs, specifically http://uncpbisdegree.com/download3.php?q=shinko-young-guitar-book.pdf and http://uncpbisdegree.com/download4.php?q=shinko-young-guitar-book.pdf, which are likely serving malicious payloads. The ML classifier also flagged this PDF with a high probability of maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8944

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=shinko-young-guitar-book.pdf PDF link annotation
    • http://uncpbisdegree.com/download4.php?q=shinko-young-guitar-book.pdfIn PDF document text
    • https://www.shinko-music.co.jp/In PDF document text
    • http://youngguitar.jp/yg/yg-201604In PDF document text
    • https://www.shinko-music.co.jp/item/pid1645278/In PDF document text
    • http://rbaraki.com/notice2-e.htmIn PDF document text
    • http://www.gepr.net/ar.htmlIn PDF document text
    • https://www.abba-intermezzo.de/ebooks.htmIn PDF document text
    • http://www005.upp.so-net.ne.jp/getoverit/In PDF document text
    • http://uncpbisdegree.com/1/short-term-training-courses-in-usa.pdfIn PDF document text
    • http://uncpbisdegree.com/1/tarzan-movie-car-designer.pdfIn PDF document text
    • http://uncpbisdegree.com/1/simple-solutions-math-grade-5.pdfIn PDF document text
    • http://uncpbisdegree.com/1/sports-trivia-questions-answers-office-shake-up.pdfIn PDF document text
    • http://uncpbisdegree.com/1/suzuki-quadracer-for-kids-manual.pdfIn PDF document text
    • http://uncpbisdegree.com/1/solution-manual-of-principle-of-power-system-by-v-k-mehta.pdfIn PDF document text
    • http://riverside-resort.net/1/wall-street-journal-business-plan.pdfIn PDF document text
    • http://uncpbisdegree.com/1/smart-roadster-user-manual.pdfIn PDF document text
    • http://uncpbisdegree.com/1/separation-process-engineering-solutions-manual-wankat.pdfIn PDF document text
    • http://uncpbisdegree.com/1/the-boy-that-never-was-kindle-edition-karen-perry.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=JA_EN&a=https%3a%2f%2fwww.shinko-music.co.jp%2fIn PDF document text
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=JA_EN&a=http%3a%2f%2fyoungguitar.jp%2fyg%2fyg-201604In PDF document text
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=JA_EN&a=https%3a%2f%2fwww.shinko-music.co.jp%2fitem%2fpid1645278%2fIn PDF document text
    • https://en.wikipedia.org/wiki/John_SykesIn PDF document text
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=JA_EN&a=http%3a%2f%2fwww005.upp.so-net.ne.jp%2fgetoverit%2fIn PDF document text
    • https://en.wikipedia.org/wiki/BUCK-TICKIn PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000040bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40BC 10248 bytes
SHA-256: 11e702c79b9bd8b5e037c48d10b51936d07fc048145fb6449da39526d8280865
font_01_sfnt_off0000614a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x614A 7472 bytes
SHA-256: cc770d37ad0d77065d1813c8314539e328c0da74139abf756c05d5dbb5fd5bc4

Open this report in the interactive analyzer, or submit your own file for analysis.