Malicious PDF — malware analysis report

Static analysis result for SHA-256 a48779367ba12062…

MALICIOUS

PDF

107.1 KB Created: 2022-06-02 04:56:19 Authoring application: Car Repair Agreement Letter sammsoft (via FPDF 1.82) First seen: 2022-07-15
MD5: a1c9dbfb4c28ed232852fb79970dc870 SHA-1: 16d377dce43861d383f624c7a4b51807a6a21ed8 SHA-256: a48779367ba1206241e8f3eaf2c8250a49cc0fb72c99ce259872550501534c0c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple embedded links, several of which are repeated and invisible, directing the user to download files from the malicious domain 'eminemreactor.site'. This technique is commonly used to deliver secondary payloads or redirect users to phishing sites. The heuristic 'PDF_REPEATED_PAYLOAD_LINK_LURE' strongly indicates this malicious intent.

Machine Learning

  • Nyx PDF Classifier clean score 0.0006

Heuristics 2

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eminemreactor.site/Car-Repair-Agreement-Letter/pdf/www.marklittler.com
    • http://eminemreactor.site/Car-Repair-Agreement-Letter/doc/www.marklittler.com
    • https://www.marklittler.com/wp-content/uploads/formidable/16/popular-work-satisfaction-questionnaire.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/la-radiance-dark-spot-renewal-serum.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/bmp-full-form-in-dentistry.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/the-definitive-peace-treaty-of-paris.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_016_off0001a14d.bin
43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1A14D 76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.