PDF malware analysis — malicious · b8b73f752354d97b

MALICIOUS

PDF

117.3 KB Created: 2022-04-17 07:06:09 Authoring application: Jesus Healing In The New Testament timer (via FPDF 1.82) First seen: 2022-07-15

MD5: 550c77b4315f938ebcafbe2695d7d720 SHA-1: d3ce8b453771f4d6d30b9f6177384d8950543aab SHA-256: b8b73f752354d97be8bada22c82dd65fcaf01bf1656c5a45764228a2e8716731

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains multiple embedded and invisible links that direct users to malicious URLs. The heuristic 'PDF_REPEATED_PAYLOAD_LINK_LURE' indicates that these links are intended to deliver a payload. The URLs extracted, such as http://alltelmouse.site/Jesus-Healing-In-The-New-Testament/pdf/sage-search.com, are suspicious and likely host the malicious content.

Machine Learning

Nyx PDF Classifier clean score 0.0042

Heuristics 2

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://alltelmouse.site/Jesus-Healing-In-The-New-Testament/pdf/sage-search.com
- http://alltelmouse.site/Jesus-Healing-In-The-New-Testament/doc/sage-search.com
- https://sage-search.com/wp-content/uploads/formidable/2/the-hartford-com-request-quote.pdf
- https://sage-search.com/wp-content/uploads/formidable/2/chase-verify-receipt-of-card.pdf
- https://sage-search.com/wp-content/uploads/formidable/2/properties-in-cv-raman-nagar-bangalore.pdf
- https://sage-search.com/wp-content/uploads/formidable/2/assurance-casse-telephone-demarche.pdf
- https://sage-search.com/wp-content/uploads/formidable/2/bbb-complaints-on-frontier-consumer-law-group.pdf
- https://sage-search.com/wp-content/uploads/formidable/2/assurance-ski-carre-neige.pdf
- https://sage-search.com/wp-content/uploads/formidable/2/attachinterrupt-digitalpintointerrupt-pin-isr-mode-recommended.pdf
- https://sage-search.com/wp-content/uploads/formidable/2/uiuc-student-health-insurance-waiver.pdf
- https://sage-search.com/wp-content/uploads/formidable/2/boston-college-new-testament-position.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_023_off0001c8a8.bin` `43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1C8A8	76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.