MALICIOUS
70
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
The file is identified as a PDF dropper by ClamAV, indicating its primary function is to deliver other malware. It contains embedded URLs that likely lead to malicious content, disguised with a call-to-action button. The presence of the PDF_URI heuristic firing on http://uncpbisdegree.com/download3.php?q=wool-wool-trilogy-series-book-1.pdf further supports this, suggesting the document is designed to trick users into downloading a malicious file disguised as a book series. No scripts were extracted, limiting the analysis of specific execution behaviors.
Heuristics 4
-
ClamAV: Pdf.Dropper.Agent-9263708-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Dropper.Agent-9263708-0
-
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTONDocument contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://uncpbisdegree.com/download3.php?q=wool-wool-trilogy-series-book-1.pdf
- http://uncpbisdegree.com/download4.php?q=wool-wool-trilogy-series-book-1.pdf
- http://pkdrei.de/wool/wool/wool_wool_trilogy_series_book_1.pdf
- http://starge.de/wool/wool/wool_wool_trilogy_series_book_1.pdf
- http://uncpbisdegree.com/1/student-nurse-interview-maths-test.pdf
- http://uncpbisdegree.com/1/soccer-training-games-drills-and-fitness-practices-8th-edition.pdf
- http://uncpbisdegree.com/1/the-immigrants-lavette-family-1-howard-fast.pdf
- http://uncpbisdegree.com/1/socioeconomic-status-and-health.pdf
- http://uncpbisdegree.com/1/solutions-for-12-4-2018-jee-main-by-aakash.pdf
- http://uncpbisdegree.com/1/the-cowboys-e-mail-order-bride-cowboys-of-chance-creek-book-1.pdf
- http://riverside-resort.net/1/unit-test-for-geometry-a-answers-on-edgenuity.pdf
- http://uncpbisdegree.com/1/steve-smith-motorsports-books.pdf
- http://uncpbisdegree.com/1/swallowing-darkness-laurell-k-hamilton-meredith-gentry-07.pdf
- http://riverside-resort.net/1/university-of-miami-mba-ranking.pdf
- https://www.goodreads.com/book/show/20745447-the-wool-trilogy
- https://www.fantasticfiction.com/h/hugh-howey/wool.htm
- https://www.reddit.com:443/r/books/comments/7tiz70/_/dtcvz4a?utm_source=BD&utm_medium=Search&utm_name=Bing&utm_content=PSR1
- https://www.reddit.com:443/r/books/comments/7tiz70/_/dtd2yic?utm_source=BD&utm_medium=Search&utm_name=Bing&utm_content=PSR1
- https://www.reddit.com:443/r/books/comments/7tiz70/_/dtdd3eb?utm_source=BD&utm_medium=Search&utm_name=Bing&utm_content=PSR1
- https://www.reddit.com:443/r/books/comments/7tiz70/_/dtdz97f?utm_source=BD&utm_medium=Search&utm_name=Bing&utm_content=PSR1
- https://www.reddit.com:443/r/books/comments/7tiz70/_/dtd568i?utm_source=BD&utm_medium=Search&utm_name=Bing&utm_content=PSR1
- https://www.reddit.com:443/r/books/comments/7tiz70/_/dtd2lxn?utm_source=BD&utm_medium=Search&utm_name=Bing&utm_content=PSR1
- https://www.amazon.com/Wool-Trilogy-Shift-Dust-ebook/dp/B00I96357W
- http://choice.microsoft.com
- https://0.r.bat.bing.com/?ld=d3qVcHPC5zm84PXMH1z37LlDVUCUxoCjRXXysVfVmUqPM7czMN3Sya71fZUDT-H-G1gdTkAlZJHVCNhhVmoFzv6CQYI-FOG19F1g2Oik9lIt-u9P3JX2YC1wjlWdBAJF6i6ic03RAjPUk1WjXCu6dGy5goMXlnCqhGpg3nNrq_eqImSelO&u=http%3a%2f%2ftracker.marinsm.com%2frd%3fcid%3dvkkb7e0xh0%26mkwid%3dwP3TP2Tg%26pcrid%3d73392450956934%26pdv%3dc%26lp%3dhttps%3a%2f%2fwww.abebooks.com%2fDust-Wool-Trilogy-3-Paperback-Hugh%2f22853132427%2fbd%3fcm_mmc%3dmsn-_-new-_-PLA-_-v01%2526cm_mmc%253Dmsn-_-Bing%252BUS%252BShopping-_-Ad%252Bgroup%252B%2525231-_-%7bproduct_groups%7d
- https://www.amazon.com/Wool-Omnibus-Kindle-Motion-Silo-ebook/dp/B0071XO8RA
- https://www.amazon.com/Kindle-eBooks/b?ie=UTF8&node=154606011
- https://www.amazon.com/Science-Fiction-Fantasy-Kindle-eBooks/b?ie=UTF8&node=668010011
- https://www.amazon.com/Wool-Trilogy-Hugh-Howey-ebook/product-reviews/B00873GRU4
- https://www.amazon.co.uk/Wool-Trilogy-Book-1-ebook/dp/B00873GRU4
- https://www.amazon.co.uk/fiction-books-eBooks-kindle/b?ie=UTF8&node=362270031
- https://www.amazon.co.uk/b?ie=UTF8&node=4542623031
- https://www.reddit.com/r/books/comments/7tiz70/i_just_read_wool_by_hugh_howey_book_1_of_the_silo/
- https://www.reddit.com:443/r/books/comments/7tiz70/i_just_read_wool_by_hugh_howey_book_1_of_the_silo/?utm_source=BD&utm_medium=Search&utm_name=Bing&utm_content=PSR1
- http://www.bookrags.com/studyguide-wool-omnibus-edition-wool-1-5-silo-saga-1/
- https://54109419.r.bat.bing.com/?ld=d3nAxmIDE4iagmYbM-In6upDVUCUxpaS9a_uVgSC0D4w-0YmWrKj7n0jtTnG2APgdmmS3Ef1WDHcOxy-PGF6pkdrWjY8u9dJE0j_Kbq_XobFKy0xm9LpcDZZU9nKorFJcwF9u24wAvw17xXbny8Mp8nRekexLP6iYX_8TL_Pj5z5COr_aO&u=http%3a%2f%2fwww.amazon.com%2fs%2f%3fie%3dUTF8%26keywords%3dwool%2btrilogy%2bhugh%2bhowey%26tag%3dmh0b-20%26index%3dstripbooks%26hvadid%3d78408977428680%26hvqmt%3db%26hvbmt%3dbb%26hvdev%3dc%26ref%3dpd_sl_3f0hv10227_b
- https://1455465.r.bat.bing.com/?ld=d3ekjKi6eq9oyad28OECgzcTVUCUyS_YBWlIKdRB536W86Nv_Abo9uAz0189ph-5rGxNtzuiVJd4ls7Fo92Qe2z4uELX_x54BaMh1sV73dX25AWb3Wr-z2zxKFllq6Ovid_oqk9lWh5xOC-IyDL0xlHnd7ZNGP6tQkKIBwPwBogCLCDeYC&u=stuccu.com%2fs%2fWool%2bTrilogy%2bBook-MbSLsTI-Buy-Exclusive-Deals-70-OFF-Save-Big-Lowest-Price-On-Wool-Trilogy-Book-Best-In-Stock-Fast-Free-Shipping%3fkeyword%3d%252Bwool%2520%252Btrilogy%2520%252Bbook%26matchtype%3db%26querystring%3dwool%2520wool%2520trilogy%2520series%2520book%25201%26netid%3d2%26aaid%3d555ea868b1b1c62388a19187%26oid%3d29348732811%26caid%3d555ea868b1b1c62388a19185%26device%3dc%26msclkid%3d%7bmscklid%7d
- https://253771.r.bat.bing.com/?ld=d3_DGyK1plxsISmGoVBuG3rjVUCUy_Q6JORRVj2QLvCPINqvPTHv7Dd_W7u9ggdJEOTOdYWv48nEjU324aasv4VuOYPISsF2P7grwj4rREwdzP4gnR02Xc4oBmR0V7n4FCuveFeUXzVYYAALCLXakqk1EC8w8A24-CPOgq_Hz3tIYDDRPF&u=http%3a%2f%2fquilting-fabric.connectingthreads.com%2fseries-books%3fmedia%3dPPCBNBT%26msclkid%3d%7bmsclkid%7d
- http://go.microsoft.com/fwlink/?LinkID=617350
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
- https://go.microsoft.com/fwlink/?linkid=868922
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
- http://go.microsoft.com/fwlink/?LinkID=617297
- https://www.reddit.com:443/r/books/comments/7tiz70/_/dtdd3eb?utm_source=BD&utm_medium=Search&utm_name=
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001197d.bin8f729782b7bac77e4a4df16f63f54e2d5945ac4475f26097705349bbaf40b711 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1197D | 14904 bytes |
font_01_sfnt_off000146ce.bin013c863f8c1362dd5bd67161914175eb2d3f3ec1905de106a609fb9176651ddf |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x146CE | 10440 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.