Malicious PDF — malware analysis report

Static analysis result for SHA-256 83c9cc2062d3884d…

MALICIOUS

PDF

33.5 KB Created: 2018-06-11 09:22:51 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2020-09-24
MD5: 1300e0f1bbfb3b9ce6fbd11e750b0fc5 SHA-1: 1e89b852d7a701f8cb0eb6a3935c6f3ab22631eb SHA-256: 83c9cc2062d3884d359d04551e0edb1ccea519e15d5de80c7c7d4e26fda13921
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains heuristics indicating it is a fake download lure, specifically using SEO poisoning to attract users searching for educational content. The embedded URLs and document body point to the domain 'uncpbisdegree.com', which is likely hosting a malicious payload disguised as a PDF. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9395

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=what-is-a-fraction.pdf PDF link annotation
    • http://uncpbisdegree.com/download4.php?q=what-is-a-fraction.pdfIn PDF document text
    • http://www.gamequarium.com/fractions.htmlIn PDF document text
    • http://www.bgfl.org/bgfl/custom/resources_ftp/client_ftp/ks2/maths/fractions/index.htmIn PDF document text
    • http://www.aaamath.com/fra.htmlIn PDF document text
    • https://www.fractionltd.com/In PDF document text
    • http://www.numeracyhelper.com/fractionwalls/In PDF document text
    • http://www.math.com/school/subject1/practice/S1U4L5/S1U4L5Pract.htmlIn PDF document text
    • http://www.elainefitzgerald.com/jeopardyfractions.pptIn PDF document text
    • http://monocleyachts.com/In PDF document text
    • http://www.superstructure.com/In PDF document text
    • http://riverside-resort.net/1/simpsons-comic-book-guy-video.pdfIn PDF document text
    • http://riverside-resort.net/1/the-parents-guide-to-successful-homeschooling.pdfIn PDF document text
    • http://riverside-resort.net/1/suzuki-swift-owners-manual-cars.pdfIn PDF document text
    • http://riverside-resort.net/1/solution-manual-cmos-vlsi-design-4th-edition.pdfIn PDF document text
    • http://riverside-resort.net/1/the-book-of-basketball-nba-according-to-sports-guy-bill-simmons.pdfIn PDF document text
    • http://riverside-resort.net/1/smoothies-for-lung-cancer-patients.pdfIn PDF document text
    • http://riverside-resort.net/1/smithsonian-handbooks-fossils.pdfIn PDF document text
    • http://riverside-resort.net/1/tuntematon-tekij.pdfIn PDF document text
    • http://riverside-resort.net/1/the-spectatorship-of-suffering.pdfIn PDF document text
    • http://riverside-resort.net/1/solution-of-digital-logic-computer-design-by-morris-mano.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://nlvm.usu.edu/en/nav/frames_asid_104_g_1_t_1.htmlIn PDF document text
    • http://www.visualfractions.com/In PDF document text
    • http://www.visualfractions.com/Games.htmIn PDF document text
    • http://www.cooks.com/rec/convert/In PDF document text
    • http://www.sheldonbrown.com/tire-sizing.htmlIn PDF document text
    • http://www.primarygames.com/fractions/question1.htmIn PDF document text
    • http://www.sheppardsoftware.com/math.htmIn PDF document text
    • http://calculationnation.nctm.org/In PDF document text
    • https://view.officeapps.live.com/op/view.aspx?src=http%3A%2F%2Fwww.elainefitzgerald.com%2Fjeopardyfractions.pptIn PDF document text
    • https://en.wikipedia.org/wiki/PrevalenceIn PDF document text
    • https://www.buzzfeed.com/searchIn PDF document text
    • https://en.wikipedia.org/wiki/DecimalIn PDF document text
    • http://www.maths.surrey.ac.uk/hosted-sites/R.Knott/Fibonacci/cfINTRO.htmlIn PDF document text
    • http://www.bbc.co.uk/bitesize/ks2/maths/number/In PDF document text
    • http://www.dailymail.co.uk/sciencetech/article-3211347/The-cheap-robotic-hand-set-revolutionise-prosthetics-3D-printed-device-performs-advanced-tasks-fraction-cost.htmlIn PDF document text
    • https://www.nctm.org/standards/In PDF document text
    • https://www.washingtonpost.com/news/the-fix/wp/2018/04/26/trumps-unwieldy-fox-and-friends-interview-annotated/In PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004945.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4945 9896 bytes
SHA-256: b84da45d69fe4c9cbc948e2e873f46f124f650f745e8fcf18a6c34cd8646ad9d
font_01_sfnt_off000068e3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x68E3 6668 bytes
SHA-256: 4784276664b4b0636f8bfdfa3f1c9e4ea4bd055ca2179de032f9e901217821e7