PDF malware analysis — malicious · 3096be207a84d5dc

MALICIOUS

PDF

118.0 KB Created: 2022-06-08 05:21:11 Authoring application: Business Expenses No Receipt alliance (via FPDF 1.82) First seen: 2022-07-15

MD5: 0b27b89e623c9f8f595082fac7f3faf0 SHA-1: 2abac4f0e05e2fdfc415f3f11cf02d3a5566a410 SHA-256: 3096be207a84d5dc7d2953a7309c5e6ed0dcdb8536a111389edd45004907c8c3

70 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains numerous invisible links that redirect to the malicious domain 'eminemreactor.site'. This domain is likely hosting a secondary payload, as indicated by the 'PDF_REPEATED_PAYLOAD_LINK_LURE' heuristic. The document's content and heuristics suggest a lure related to business expenses or invoices, aiming to trick the user into downloading malicious content.

Machine Learning

Nyx PDF Classifier clean score 0.0038

Heuristics 3

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://eminemreactor.site/Business-Expenses-No-Receipt/pdf/www.marklittler.com
- http://eminemreactor.site/Business-Expenses-No-Receipt/doc/www.marklittler.com
- https://www.marklittler.com/wp-content/uploads/formidable/16/will-yovanovitch-testimony-be-televised.pdf
- https://www.marklittler.com/wp-content/uploads/formidable/16/google-event-notification-sound.pdf
- https://www.marklittler.com/wp-content/uploads/formidable/16/directions-to-jackson-new-hampshire.pdf
- https://www.marklittler.com/wp-content/uploads/formidable/16/revenue-canada-non-resident-tax-forms.pdf
- https://www.marklittler.com/wp-content/uploads/formidable/16/most-choices-are-revocable-means.pdf
- https://www.marklittler.com/wp-content/uploads/formidable/16/personal-shopper-parents-guide.pdf
- https://www.marklittler.com/wp-content/uploads/formidable/16/application-for-a-scholarship-example.pdf
- https://www.marklittler.com/wp-content/uploads/formidable/16/design-and-vhdl-handbook-for-vlsi-development.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_024_off0001cb90.bin` `43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1CB90	76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.