PDF malware analysis — malicious · d917a9fda706ff3a

MALICIOUS

PDF

106.4 KB Created: 2022-06-28 21:53:47 Authoring application: Fungicide Application Timing On Soybeans sweeper (via FPDF 1.82) First seen: 2022-07-15

MD5: 3a4ad04db95599ea44b8b800a4d31fc0 SHA-1: c778f3ceff585fd123e575113d20a34ac8185d85 SHA-256: d917a9fda706ff3a122a18a7afeb467917dcbecfeefc6e1293e77dad1ebf3350

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains multiple invisible links that repeatedly point to the URL http://particlecommit.site/Fungicide-Application-Timing-On-Soybeans/pdf/elisautobody.com. This heuristic indicates a lure to download a payload, likely disguised as a document related to fungicide application timing. The presence of numerous embedded URLs suggests a broad phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier clean score 0.0007

Heuristics 2

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://particlecommit.site/Fungicide-Application-Timing-On-Soybeans/pdf/elisautobody.com
- http://particlecommit.site/Fungicide-Application-Timing-On-Soybeans/doc/elisautobody.com
- https://elisautobody.com/wp-content/uploads/formidable/7/proofs-involving-similar-triangles-worksheet-answer-key.pdf
- https://elisautobody.com/wp-content/uploads/formidable/7/truck-driver-expenses-worksheet.pdf
- https://elisautobody.com/wp-content/uploads/formidable/7/annual-review-powerpoint-presentation.pdf
- https://elisautobody.com/wp-content/uploads/formidable/7/east-west-properties-bashundhara-group.pdf
- https://elisautobody.com/wp-content/uploads/formidable/7/osmosis-worksheet-middle-school.pdf
- https://elisautobody.com/wp-content/uploads/formidable/7/trade-agreement-that-the-us-is-currently-negotiating.pdf
- https://elisautobody.com/wp-content/uploads/formidable/7/facebook-notification-content-not-found.pdf
- https://elisautobody.com/wp-content/uploads/formidable/7/age-for-getting-a-tattoo-with-parental-consent-fl.pdf
- https://elisautobody.com/wp-content/uploads/formidable/7/my-ohio-course-offerings.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_016_off00019df0.bin` `43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x19DF0	76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.