Malicious PDF — malware analysis report

Heuristics 5

• Image-only PDF phishing link embeds recipient email critical PDF_IMAGE_LURE_RECIPIENT_EMAIL_LINK
  PDF is an image-heavy/sparse-text lure and its clickable URL carries the recipient email address as a query parameter on non-reputable infrastructure. That combination is typical of credential-phishing kits that render the lure as pixels while pre-filling or tracking the victim on the landing page.
• Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
  PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
• Clickable URL embeds a recipient email address as a tracking parameter high PDF_URL_RECIPIENT_EMAIL_PARAM
  PDF has a clickable HTTP(S) action whose URL carries a recipient email address as a query parameter (e.g. '?e=victim@example.com') on a host that is not known-good. Phishing kits stamp the target's address into the link so the landing page pre-fills the credential form and tracks the open per recipient; a delivered legitimate link rarely carries the recipient's address in cleartext. Complements PDF_URL_MAILMERGE_PLACEHOLDER, which catches the unrendered token.
• Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
  PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 105 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
• Embedded URL info EMBEDDED_URL
  One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
  URL https://sensomotorikzentrum-bremen.com/lapo/index.php?email=tw.geneugelijk@royalihc.com In PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.