PDF malware analysis — malicious · 85025ade6a6056af

MALICIOUS

PDF

104.0 KB Created: 2022-04-20 06:17:38 Authoring application: Ucc Application To Agricultural Liens skin (via FPDF 1.82) First seen: 2022-07-15

MD5: 543d20a7e97ecbb0fd79cafe9bc1c230 SHA-1: 72b229d9f11277c6293fdbea9723a36a85cc3af1 SHA-256: 85025ade6a6056afec67a0d50af01aa56637956d7d7704420d2568203aa5bb84

70 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple invisible links and uses language suggestive of an invoice or payment request. The primary heuristic indicates these links are designed to deliver a payload from the URL http://carbideacces.site/Ucc-Application-To-Agricultural-Liens/pdf/dileogas.com. The embedded URLs are likely used to host or redirect to malicious content.

Machine Learning

Nyx PDF Classifier clean score 0.0007

Heuristics 3

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://carbideacces.site/Ucc-Application-To-Agricultural-Liens/pdf/dileogas.com
- http://carbideacces.site/Ucc-Application-To-Agricultural-Liens/doc/dileogas.com
- https://dileogas.com/wp-content/uploads/formidable/4/excess-of-loss-treaty-insurance.pdf
- https://dileogas.com/wp-content/uploads/formidable/4/sam-axe-burn-notice-dead.pdf
- https://dileogas.com/wp-content/uploads/formidable/4/average-interest-rate-for-contract-for-deed.pdf
- https://dileogas.com/wp-content/uploads/formidable/4/notary-public-hollywood-fl.pdf
- https://dileogas.com/wp-content/uploads/formidable/4/offers-in-indian-restaurant-near-me.pdf
- https://dileogas.com/wp-content/uploads/formidable/4/louisville-football-home-schedule.pdf
- https://dileogas.com/wp-content/uploads/formidable/4/a-counselor-with-a-pupil-certification-salary.pdf
- https://dileogas.com/wp-content/uploads/formidable/4/fix-ssl-certificate-name-mismatch-error.pdf
- https://dileogas.com/wp-content/uploads/formidable/4/check-if-you-have-arrest-warrant.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_016_off00019463.bin` `43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x19463	76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.