Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdf6aeb992e87d68…

MALICIOUS

PDF

112.4 KB Created: 2022-05-31 15:07:01 Authoring application: Christians Not To Marry Unbeliever Biblical Reference girl (via FPDF 1.82) First seen: 2022-07-15
MD5: 16f7c6a57ec9eb816543e27e2bc1d6e0 SHA-1: f76a9db8c77171938e0c4d8af348774a495ce731 SHA-256: cdf6aeb992e87d68416ffb9c301e65075f4b12026852788ea94e8c76df1f910c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains multiple invisible and repeated links that direct users to a malicious domain, eminenreactor.site. This domain is likely hosting a secondary payload. The heuristic 'PDF_REPEATED_PAYLOAD_LINK_LURE' strongly indicates a malicious intent to trick users into downloading and executing further malware. No scripts were extracted from this sample, limiting the ability to determine specific execution methods.

Machine Learning

  • Nyx PDF Classifier clean score 0.0008

Heuristics 2

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eminemreactor.site/Christians-Not-To-Marry-Unbeliever-Biblical-Reference/pdf/www.marklittler.com
    • http://eminemreactor.site/Christians-Not-To-Marry-Unbeliever-Biblical-Reference/doc/www.marklittler.com
    • https://www.marklittler.com/wp-content/uploads/formidable/16/ankulua-pro-summoners-war.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/alcohol-units-per-week-recommended.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/totally-free-conference-calls-complaints.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/wishing-happy-birthday-to-my-mother-in-law.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/wisconsin-sales-and-use-tax-exemption-certificate.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/intention-to-treat-vs-per-protocol-treatment.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/love-thy-neighbour-bible-reference.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_019_off0001b55e.bin
43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B55E 76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.