Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae9dbb5afc458c18…

MALICIOUS

PDF

32.7 KB Created: 2018-06-11 09:38:25 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: f98e19e27f4421dac68c94c741279f96 SHA-1: 7ea15fbd3dc5fa80ada9f8032ba50e9da82c1b76 SHA-256: ae9dbb5afc458c189073d0012baa222468634363971f19ed39b1a5489e9d8aca
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains multiple embedded and invisible links designed to trick the user into downloading a payload, masquerading as textbook rental information. The heuristic 'PDF_REPEATED_PAYLOAD_LINK_LURE' indicates that these links are intentionally repeated and hidden to increase the likelihood of user interaction. The document body and extracted URLs reinforce the theme of textbook rentals, further serving as a lure.

Heuristics 4

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=textbook-rental-alibris.pdf
    • http://uncpbisdegree.com/download4.php?q=textbook-rental-alibris.pdf
    • http://www.textbookspyder.com/
    • http://www.lecoqshabille.com/general/general-biology-lab-manual-custom-edition-answers.pdf
    • http://www.bookfinder4u.com/
    • https://givingassistant.org/coupon-codes/chegg.com
    • http://events.digitalfertilizer.org/th/the-writers-harbrace-handbook-resourceful-reader-zrm3tr.pdf
    • http://webgerman.com/germlinks/
    • http://www.brian-t-murphy.com/Eng102.htm
    • https://www.dealsplus.com/stores
    • http://www.brian-t-murphy.com/Eng100.htm
    • http://www.booksandcollectibles.com.au/links/book-search-engines.html
    • http://uncpbisdegree.com/1/steve-mcqueen-documentary.pdf
    • http://uncpbisdegree.com/1/study-questions-world-war-1.pdf
    • http://riverside-resort.net/1/zundels-abgang-roman-taschenbuch-markus-werner.pdf
    • http://uncpbisdegree.com/1/simple-solutions-mathematics-level-5.pdf
    • http://riverside-resort.net/1/video-game-strategy-guides-online.pdf
    • http://uncpbisdegree.com/1/teacher-apos-s-handbook-of-biology.pdf
    • http://riverside-resort.net/1/what-dreams-may-come.pdf
    • http://riverside-resort.net/1/used-engineering-books-for-sale.pdf
    • http://uncpbisdegree.com/1/teaching-transparency-worksheet-phase-diagrams-answers.pdf
    • http://riverside-resort.net/1/unisa-2018-prospectus.pdf
    • http://riverside-reso
    • https://www.consumeraffairs.com/education/textbook-rental/
    • http://www.finaid.org/questions/textbooks.phtml
    • https://www.retailmenot.com/view/chegg.com
    • https://www.retailmenot.com/view/ecampus.com
    • https://www.barnesandnoble.com/b/textbooks/_/N-8q9
    • https://www.groupon.com/coupons/stores/barnesandnoble
    • https://www.groupon.com/coupons
    • https://www.groupon.com/coupons/categories/books-magazines
    • https://www.offers.com/back-to-school/
    • https://www.offers.com/holiday/
    • https://www.digitalcommerce360.com/internet-retailer/
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000044f8.bin
9a05b03107627564314192dfd396bb925cfe20e5f7424417104ab36f0a427ef0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x44F8 10208 bytes
font_01_sfnt_off00006579.bin
1c39c1d1a727edf455e3454bd72ec0d6bc2d0e7f1373be3ca5055a6810e037ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6579 6968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.