PDF malware analysis — malicious · ad757438c068a57b

MALICIOUS

PDF

117.3 KB Created: 2022-07-08 16:44:00 Authoring application: Gamo Bone Collector Modifications silicon (via FPDF 1.82) First seen: 2022-07-15

MD5: 3c182b75c153a3e86061a1c44839e540 SHA-1: 2b02bb5e23059c5e09a021eb4f54c9935220b64a SHA-256: ad757438c068a57b287940695183bc6ec4306e4b2426d095d3904bfab4fa044c

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded and invisible links designed to trick the user into clicking them. These links point to external URLs, specifically 'http://resumeskayako.site/Gamo-Bone-Collector-Modifications/pdf/yourexperiencesmatter.com', which likely serve as a distribution point for a malicious payload. The use of repeated, invisible links is a common social engineering tactic to facilitate the download of further malware.

Machine Learning

Nyx PDF Classifier clean score 0.0013

Heuristics 2

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://resumeskayako.site/Gamo-Bone-Collector-Modifications/pdf/yourexperiencesmatter.com
- http://resumeskayako.site/Gamo-Bone-Collector-Modifications/doc/yourexperiencesmatter.com
- https://yourexperiencesmatter.com/wp-content/uploads/formidable/8/the-state-bar-of-california-attorney-complaint-form.pdf
- https://yourexperiencesmatter.com/wp-content/uploads/formidable/8/mueller-subpoena-foreign-company.pdf
- https://yourexperiencesmatter.com/wp-content/uploads/formidable/8/right-to-vote-constitution-of-the-united-states.pdf
- https://yourexperiencesmatter.com/wp-content/uploads/formidable/8/dorchester-county-md-property-tax-search.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_022_off0001c8bb.bin` `43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1C8BB	76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.