MALICIOUS
62
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains multiple heuristics indicating it is designed to trick users into downloading a payload. Specifically, it uses invisible and repeated links to deliver 'MineForTheEye.zip' from 'skitty.cloud.seedboxes.cc'. The embedded URLs also point to 'the-eye.eu' and '10gbps.io', suggesting a potential distribution network. The primary attack pattern involves luring the user to download a malicious archive.
Machine Learning
- Nyx PDF Classifier clean score 0.0075
Heuristics 3
-
Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LUREPDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://the-eye.eu/
- https://10gbps.io/?utm_source=the-eye.eu&utm_medium=referral&utm_campaign=sponsorship-the-eye&utm_content=link
- https://skitty.cloud.seedboxes.cc/MineForTheEye.zip
- https://discord.gg/WjXmqNT
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_009_off00014f57.bin29bc97f8122d6c595abf1862479435dcdf558aab3d79806c5456ed916078a236 |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x14F57 | 43824 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.