Malicious PDF — malware analysis report

Static analysis result for SHA-256 b78f063aa9100a40…

MALICIOUS

PDF

28.9 KB Created: 2018-06-11 10:00:57 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2020-09-15
MD5: 7f998bb10d92c0892bb43d6e8f58e9d2 SHA-1: 5f93e02f3f12e423a03b5f1a7829d3ffe9e35023 SHA-256: b78f063aa9100a408e576d1b501c1c7bbd6b12ea121f2bdc7822f1115dec3094
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier and contains heuristics indicating it is a fake download lure designed for SEO poisoning. The document body and extracted URLs point to a malicious domain, uncpbisdegree.com, which is likely serving a second-stage payload disguised as an educational PDF. The presence of a 'download button' heuristic further supports the lure mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9677

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=surface-area-of-pyramids-and-cones-kuta.pdf PDF link annotation
    • http://uncpbisdegree.com/download4.php?q=surface-area-of-pyramids-and-cones-kuta.pdfIn PDF document text
    • http://www.kutasoftware.com/freeige.htmlIn PDF document text
    • http://atez.bicyclebenefits.info/sildigra/manta-perfilada-herbal-viagra-sale.htmIn PDF document text
    • http://uncpbisdegree.com/1/the-boy-who-dared-susan-campbell-bartoletti.pdfIn PDF document text
    • http://riverside-resort.net/1/xtremepapers-igcse-thresholds.pdfIn PDF document text
    • http://riverside-resort.net/1/we-who-are-alive-and-remain-untold-stories-from-the-band-of-brothers-marcus-brotherton.pdfIn PDF document text
    • http://riverside-resort.net/1/waec-physics-answers.pdfIn PDF document text
    • http://riverside-resort.net/1/walt-disney-his-life-in-pictures.pdfIn PDF document text
    • http://uncpbisdegree.com/1/smith-van-ness-7th-edition.pdfIn PDF document text
    • http://uncpbisdegree.com/1/the-earth-trembles.pdfIn PDF document text
    • http://riverside-resort.net/1/volume-of-cylinders-and-cones.pdfIn PDF document text
    • http://riverside-resort.net/1/user-manual-of-un40h6350afxzc.pdfIn PDF document text
    • http://uncpbisdegree.com/1/separatism-among-indian-muslims-the-politics-of-the-united-provinces-muslims-1860-1923.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.dictionary.com/e/s/word-of-the-year-list/In PDF document text
    • http://www.microsofttranslator.com/bv.aspx?ref=SERP&br=ro&mkt=en-US&dl=en&lp=PT_EN&a=http%3a%2f%2fatez.bicyclebenefits.info%2fsildigra%2fmanta-perfilada-herbal-viagra-sale.htmIn PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35C6 10988 bytes
SHA-256: d478805f4d62ffbeb5cf8804abffd9190c6032a3671330d42cb423fed8457b3b
font_01_sfnt_off00005875.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5875 6920 bytes
SHA-256: 45298a0c91c53b82566453549ecf303d974807dbb453d5718cd70833314fc0cc

Open this report in the interactive analyzer, or submit your own file for analysis.