MALICIOUS
62
Risk Score
Malware Insights
MITRE ATT&CK
T1566.002 Spearphishing Attachment
T1059.001 PowerShell
The PDF file contains multiple embedded and invisible links that direct the user to download a payload from the domain 'waldemarillegal.site'. This technique is commonly used to trick users into downloading and executing malware. No scripts were extracted, but the heuristic firings strongly indicate a malicious payload delivery mechanism.
Machine Learning
- Nyx PDF Classifier clean score 0.0018
Heuristics 2
-
Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LUREPDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://waldemarillegal.site/Postnuptial-Agreement-Illinois-Sample/pdf/eurautoshop.com
- http://waldemarillegal.site/Postnuptial-Agreement-Illinois-Sample/doc/eurautoshop.com
- https://eurautoshop.com/wp-content/uploads/formidable/2/jones-family-cs-sewing-machine-manual.pdf
- https://eurautoshop.com/wp-content/uploads/formidable/2/alexander-hamilton-observations-on-certain-documents.pdf
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
stream_011_off00017b76.bin43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c |
decompressed-pdf-stream | PDF FlateDecoded stream at offset 0x17B76 | 76950 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.