Malicious PDF — malware analysis report

Static analysis result for SHA-256 df43987804a8e8dc…

MALICIOUS

PDF

32.8 KB Created: 2018-06-11 09:42:00 -04:00 Authoring application: wkhtmltopdf 0.12.4 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 2fedad0445f210f8236431adf8de97e2 SHA-1: 1e4d03a846a53a06adb2d3d17c8d1e10f1eb2f29 SHA-256: df43987804a8e8dc5fb2eff2912b90111135c11ff387a4f689124d125b5b2600
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is identified as malicious by an ML classifier and heuristics indicate it uses SEO poisoning to trick users into downloading a file. The document body contains URLs that are likely part of this lure, directing users to download3.php and download4.php on uncpbisdegree.com. This suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9123

Heuristics 4

  • Fake 'free download' SEO-poisoning PDF critical PDF_SEO_FAKE_DOWNLOAD
    The ML classifier flagged this PDF AND it carries a visual download/call-to-action lure AND an off-domain server-side download-gateway link whose query string names a document payload. This three-signal conjunction is the fake-document / 'free PDF download' SEO-poisoning delivery pattern: the page is padded with benign decoy links to dilute classifier scores while funnelling the victim through the gateway to malware/scareware. Acting only on the conjunction keeps benign download-bearing PDFs from being misflagged.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uncpbisdegree.com/download3.php?q=traditional-tai-arts-in-contemporary-perspective-studies-in-contemporary.pdf PDF link annotation
    • http://uncpbisdegree.com/download4.php?q=traditional-tai-arts-in-contemporary-perspective-studies-in-contemporary.pdfIn PDF document text
    • http://www.thewalkingtiger.com/In PDF document text
    • http://www.taichischoolchina.com/In PDF document text
    • http://www.egreenway.com/taichichuan/longyang.htmIn PDF document text
    • https://www.sais-jhu.edu/graduate-studies/campuses/nanjing-chinaIn PDF document text
    • http://www.egreenway.com/taichichuan/cane.htmIn PDF document text
    • http://www.everyculture.com/Sa-Th/Thailand.htmlIn PDF document text
    • http://www.everyculture.com/Sa-Th/index.htmlIn PDF document text
    • http://reinertfineart.com/In PDF document text
    • http://www.123helpme.com/search.asp?text=performing+artsIn PDF document text
    • http://julesplace.com/artists/In PDF document text
    • http://www.antiquityofman.com/recommendedreadings.htmlIn PDF document text
    • https://lecticalive.org/about/articlesIn PDF document text
    • http://riverside-resort.net/1/us-navy-ships-agent-orange-list.pdfIn PDF document text
    • http://uncpbisdegree.com/1/servsafe-alcohol-exam-questions-and-answers.pdfIn PDF document text
    • http://riverside-resort.net/1/walter-mitty-quiz-answers.pdfIn PDF document text
    • http://uncpbisdegree.com/1/study-opportunities-in-australia.pdfIn PDF document text
    • http://uncpbisdegree.com/1/steven-alter-the-work-system-method.pdfIn PDF document text
    • http://riverside-resort.net/1/wileyplus-intermediate-accounting-15th-edition-answers.pdfIn PDF document text
    • http://uncpbisdegree.com/1/solution-manual-mark-stamp.pdfIn PDF document text
    • http://riverside-resort.net/1/visiting-card-design-charges.pdfIn PDF document text
    • http://uncpbisdegree.com/1/suzuki-bandit-1200s-manual.pdfIn PDF document text
    • http://uncpbisdegree.com/1/the-cambridge-companion-to-henry-david-thoreau.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://en.wikipedia.org/wiki/Tai_chi_chuanIn PDF document text
    • https://en.wikipedia.org/wiki/QigongIn PDF document text
    • http://www.jstor.org/subject/anthropologyIn PDF document text
    • https://libraries.psu.edu/databasesIn PDF document text
    • http://www.iep.utm.edu/durkheim/In PDF document text
    • https://www.psychologytoday.com/us/blog/inside-the-box/201402/thinking-outside-the-box-misguided-ideaIn PDF document text
    • http://go.microsoft.com/fwlink/?LinkId=521839&CLCID=0409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=246338&CLCID=0409In PDF document text
    • https://go.microsoft.com/fwlink/?linkid=868922In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=286759&CLCID=409In PDF document text
    • http://go.microsoft.com/fwlink/?LinkID=617297In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000461a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x461A 10208 bytes
SHA-256: a287bd138ca4a6988e36a372be23c58d00ac383aeafbb5c4c22e72c0eb2212a2
font_01_sfnt_off00006692.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6692 6852 bytes
SHA-256: 96689bc6bb839e5aa1abf353c1312d71f866677e339e3eaea29325c5d69d0649

Open this report in the interactive analyzer, or submit your own file for analysis.