PDF malware analysis — malicious · a1a4ee180e088302

MALICIOUS

PDF

90.2 KB Created: 2018-06-11 08:59:31 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)

MD5: ddfa80191a1738149a0722e319f9398e SHA-1: e47d6346ca915a82107f23d762c212b6626060f7 SHA-256: a1a4ee180e08830222249c3a872e395d77156efd9b42a9d84cac213c5ad4b071

70 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF file contains embedded URLs that mimic legitimate Wikipedia links but point to a suspicious domain, uncpbisdegree.com. The ClamAV heuristic identifies it as a Pdf.Dropper.Agent, indicating its purpose is to deliver a payload. The document body also contains a visual call-to-action, further supporting the lure to download a malicious file.

Heuristics 4

ClamAV: Pdf.Dropper.Agent-9257539-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Dropper.Agent-9257539-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://uncpbisdegree.com/download3.php?q=wikipedia-systems-engineering.pdf
- http://uncpbisdegree.com/download4.php?q=wikipedia-systems-engineering.pdf
- http://sebokwiki.org/wiki/Systems_Engineering_Overview
- http://sebokwiki.org/wiki/Guide_to_the_Systems_Engineering_Body_of_Knowledge_\(SEBoK\
- http://uncpbisdegree.com/1/silent-sentinels-traditional-architecture-of-coorg-1st-published.pdf
- http://uncpbisdegree.com/1/student-study-guide-for-confidence-in-public-speaking-telecourse-version-8th-edition.pdf
- http://uncpbisdegree.com/1/strong-convictions-an-emmett-strong-western-emmett-strong-westerns-book-1.pdf
- http://riverside-resort.net/1/wiring-diagrams-volkswagen-lt-24.pdf
- http://uncpbisdegree.com/1/sql-interview-questions-and-answers-webs-2.pdf
- http://riverside-resort.net/1/wait-for-the-rain-maria-murnane.pdf
- http://uncpbisdegree.com/1/sequencing-cut-and-paste-printables.pdf
- http://riverside-resort.net/1/viewsonic-e771-user-guide.pdf
- http://riverside-resort.net/1/vocabulary-workshop-level-review-units-answers.pdf
- http://uncpbisdegree.com/1/serway-physics-solutions-8th-edition-manual.pdf
- https://en.wikipedia.org/wiki/System_of_systems_engineering
- https://en.wikipedia.org/wiki/Systems_engineering
- https://en.wikipedia.org/wiki/INCOSE
- http://creativecommons.org/licenses/by-sa/3.0/
- https://en.wikipedia.org/wiki/Category:Systems_engineering
- https://en.wikipedia.org/wiki/List_of_systems_engineers
- https://en.wikipedia.org/wiki/List_of_systems_engineering_universities
- https://en.wikipedia.org/wiki/List_of_systems_engineering_universities#Systems_engineering_degrees_in_Europe
- https://en.wikipedia.org/wiki/List_of_systems_engineering_universities#Systems_engineering_degrees_in_the_US
- https://en.wikipedia.org/wiki/List_of_systems_engineering_universities#Systems_Engineering_degrees_in_other_countries
- https://simple.wikipedia.org/wiki/Systems_engineering
- https://en.wikipedia.org/wiki/Engineering
- https://en.wikipedia.org/wiki/Engineering#Definition
- https://en.wikipedia.org/wiki/Engineering#History
- https://en.wikipedia.org/wiki/Engineering#Main_branches_of_engineering
- https://en.wikipedia.org/wiki/Engineering#Practice
- https://en.wikipedia.org/wiki/Engineering#Methodology
- https://en.wikipedia.org/wiki/Wikipedia:WikiProject_Systems/List_of_systems_engineering_books
- https://en.wikipedia.org/wiki/System
- https://en.wikipedia.org/wiki/System#Etymology
- https://en.wikipedia.org/wiki/System#History
- https://en.wikipedia.org/wiki/System#Concepts
- https://en.wikipedia.org/wiki/System#Analysis
- https://en.wikipedia.org/wiki/System#Application_of_the_system_concept
- http://go.microsoft.com/fwlink/?LinkID=617350
- http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
- http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
- https://go.microsoft.com/fwlink/?linkid=868922
- http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
- http://go.microsoft.com/fwlink/?LinkID=617297
- https://en.wikipedia.org/wiki/Engineeri

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000116c6.bin` `41a8a29db0ee8c9d8392c0ab675c5bfcfb0aea6cdfb98a2c7c36bd49b2ae56f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x116C6	13740 bytes
`font_01_sfnt_off000140bf.bin` `141c22f8f39697e1b7a97ced7833e544811d30531d564e7775eca6aa8ca7ffcd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x140BF	7976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.