PDF malware analysis — malicious · e9ba23272fde89c2

MALICIOUS

PDF

124.8 KB Created: 2022-07-07 14:35:49 Authoring application: Letter Postage Rate Us To Japan audiogon (via FPDF 1.82) First seen: 2022-07-15

MD5: b810e598ae633c21b51ee516be2056d0 SHA-1: cde1b2fdb3e380230cd4014049c4521dd7e7bdeb SHA-256: e9ba23272fde89c20a153950b607652e2bd46a226e1d4bdc42f7218666f4d300

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple invisible links that direct the user to download a payload from the domain 'msfnbldc.site'. This technique is commonly used to trick users into executing malicious files disguised as legitimate documents. No scripts were extracted, but the heuristic firings strongly indicate a malicious payload delivery mechanism.

Machine Learning

Nyx PDF Classifier clean score 0.0013

Heuristics 2

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://msfnbldc.site/Letter-Postage-Rate-Us-To-Japan/pdf/napacareersearch.com
- http://msfnbldc.site/Letter-Postage-Rate-Us-To-Japan/doc/napacareersearch.com
- https://napacareersearch.com/wp-content/uploads/formidable/2/psychology-tenth-edition-myers-study-guide.pdf
- https://napacareersearch.com/wp-content/uploads/formidable/2/andrew-highschool-transcript-graduation-date.pdf
- https://napacareersearch.com/wp-content/uploads/formidable/2/buy-property-in-thane-west.pdf
- https://napacareersearch.com/wp-content/uploads/formidable/2/bpp-higher-rights-handbook.pdf
- https://napacareersearch.com/wp-content/uploads/formidable/2/mutual-consent-divorce-agreement.pdf
- https://napacareersearch.com/wp-content/uploads/formidable/2/resume-skills-list-for-students.pdf
- https://napacareersearch.com/wp-content/uploads/formidable/2/if-you-get-subpoenaed-to-court.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_027_off0001e633.bin` `43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1E633	76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.