Malicious PDF — malware analysis report

Static analysis result for SHA-256 983c38a4acc30689…

MALICIOUS

PDF

119.7 KB Created: 2022-04-06 06:39:19 Authoring application: Brookhaven College Transcript Request portal (via FPDF 1.82) First seen: 2022-07-15
MD5: 1bef5c881cc39858c345604d9d10aac0 SHA-1: 9f7900e5498839a4bc10edeafd99f9241bcb9cc6 SHA-256: 983c38a4acc3068977d91451b4130900b8b232dad758728ec782e88480ce628d
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document employs a combination of a fake CAPTCHA and an advance-fee scam lure to deceive the user. It contains multiple invisible and repeated links that are designed to deliver a payload. The primary URL associated with the payload delivery is http://adultsqualquer.site/Brookhaven-College-Transcript-Request/pdf/www.mitchelladjusting.com.

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 4

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adultsqualquer.site/Brookhaven-College-Transcript-Request/pdf/www.mitchelladjusting.com
    • http://adultsqualquer.site/Brookhaven-College-Transcript-Request/doc/www.mitchelladjusting.com
    • https://www.mitchelladjusting.com/wp-content/uploads/formidable/1/report-a-website-to-google-for-copyright.pdf
    • https://www.mitchelladjusting.com/wp-content/uploads/formidable/1/mrsa-infection-treatment-protocol.pdf
    • https://www.mitchelladjusting.com/wp-content/uploads/formidable/1/nys-disability-insurance-employer-requirements.pdf
    • https://www.mitchelladjusting.com/wp-content/uploads/formidable/1/vice-president-of-sales-resume-examples.pdf
    • https://www.mitchelladjusting.com/wp-content/uploads/formidable/1/dignity-health-application-status.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_021_off0001d29c.bin
43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1D29C 76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.