Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce0cfeedaca4dc26…

MALICIOUS

PDF

43.5 KB Created: 2018-06-11 09:28:09 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7)
MD5: b3bcd4d32ca8051721feb809db1cc62d SHA-1: bc142b4346f901b8697a0e315d7f3487476170bc SHA-256: ce0cfeedaca4dc269c54bd62a45223c1091d3b676ca2ade251b7b5cae5e6632b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF document contains multiple external URIs and an IP address literal pointing to potential malware download locations. The presence of a 'download button' heuristic further suggests a lure to trick the user into downloading a malicious file. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9071

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=spare-parts-manual-manta-2-0.pdf
    • http://uncpbisdegree.com/download4.php?q=spare-parts-manual-manta-2-0.pdf
    • http://hanies.de/spare/parts/spare_parts_manual_manta_2_0.pdf
    • http://castlevillez.com/pdf-reader/spare-parts-manual-manta-2-0.pdf
    • http://wixbox.de/spare/parts/spare_parts_manual_manta_2_0.pdf
    • http://suchas.de/spare/parts/spare_parts_manual_manta_2_0.pdf
    • http://45.32.74.13/spare/parts_592/spare_parts_manual_manta_2_0.pdf
    • http://bzzbzz.de/spare/parts/spare_parts_manual_manta_2_0.pdf
    • http://sklera.de/spare/parts/spare_parts_manual_manta_2_0.pdf
    • http://risewell.solutions/spare/parts/spare_parts_manual_manta_2_0.pdf
    • http://asiyah.de/spare/parts/spare_parts_manual_manta_2_0.pdf
    • http://www.vauxhallgreenparts.co.uk/Manta.html
    • http://www.bukh-bremen.de/files/346/upload/Hersteller/ZF/Reparaturanleitung
    • http://www.mantaworld.com/opel-manta-parts/
    • http://uncpbisdegree.com/1/tecumseh-lh195sp-engine-repair-manual.pdf
    • http://riverside-resort.net/1/yamaha-125-grizzly-engine-repair.pdf
    • http://uncpbisdegree.com/1/shocking-heaven-room-103-1-dh-sidebottom.pdf
    • http://uncpbisdegree.com/1/suzuki-tc-120-wiring-diagram.pdf
    • http://uncpbisdegree.com/1/staphylococcus-epidermis.pdf
    • http://uncpbisdegree.com/1/statistics-solutions-manual-13th-edition.pdf
    • http://riverside-resort.net/1/wallenberg-missing-hero.pdf
    • http://uncpbisdegree.com/1/solution-for-elasticity-ugural.pdf
    • http://riverside-resort.net/1/what-is-thomas-edison-famous-for.pdf
    • http://uncpbisdegree.com/1/subtle-aromatherapy.pdf
    • http://go.microsoft
    • http://go.microsoft.com/fwlink/?LinkID=617350
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409
    • https://go.microsoft.com/fwlink/?linkid=868922
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409
    • http://go.microsoft.com/fwlink/?LinkID=617297

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000621e.bin
9f2b41721674d3279c826f7517f67e52055a496a42d8362092920f7912ae9fe4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x621E 13624 bytes
font_01_sfnt_off00008c46.bin
d08ebd7b45074294fbf7b375ba5e7db4ac4cb17f5dcea17c0301c4e218eee997		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C46 7968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.