PDF malware analysis — malicious · ed0e13a57ffe5762

MALICIOUS

PDF

118.0 KB Created: 2022-07-08 01:35:53 Authoring application: Notice Of Foreclosure Sale To Irs dyxum (via FPDF 1.82) First seen: 2022-07-15

MD5: 06d83b78743b00e76be7969907a23420 SHA-1: 24637bbbd23426a8eb8e935edf3b0a8188634e97 SHA-256: ed0e13a57ffe576280257a3e4bf0b35b432027b51c0fcf347d5a1e6578b7ab1d

110 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple invisible links, identified by the PDF_REPEATED_PAYLOAD_LINK_LURE heuristic, which are designed to deliver a payload. The document's content and heuristics indicate it's an advance-fee scam, likely attempting to lure victims into downloading malware by posing as a foreclosure notice. The embedded URLs are the primary indicators for payload delivery.

Machine Learning

Nyx PDF Classifier clean score 0.0007

Heuristics 4

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE

Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://causedblack.site/Notice-Of-Foreclosure-Sale-To-Irs/pdf/silixa.com
- http://causedblack.site/Notice-Of-Foreclosure-Sale-To-Irs/doc/silixa.com
- https://silixa.com/wp-content/uploads/formidable/8/invoice-payments-payables-process-flow.pdf
- https://silixa.com/wp-content/uploads/formidable/8/hip-hop-dance-instruction-dvd.pdf
- https://silixa.com/wp-content/uploads/formidable/8/affidavit-of-non-use-nv.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_018_off0001cc1d.bin` `43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x1CC1D	76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.