PDF malware analysis — malicious · efcf2f13dd57f4f7

MALICIOUS

PDF

67.6 KB

MD5: d341a4d2e73f408e096a8e0dad8538a4 SHA-1: 806fe166c7828b0016d66a918e5938348051c46e SHA-256: efcf2f13dd57f4f7e2a4e7037104c6fceda84ce4effdc74873f11af715a3ea14

80 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file is identified as malicious due to its structure, which includes an image-only lure and repeated invisible links. The primary heuristic, 'PDF_REPEATED_PAYLOAD_LINK_LURE', indicates that the embedded URL 'https://kontaktlines.com/us.kuehne-nagel.com' is used to deliver a payload. The document body contains this URL along with what appears to be obfuscated or corrupted data, further suggesting malicious intent. The overall attack pattern points towards a phishing or malware distribution scheme.

Machine Learning

Nyx PDF Classifier clean score 0.0024

Heuristics 3

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 2 image(s), only 2 text block(s), carries a click-outward action, and is only 67 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.

URL https://kontaktlines.com/us.kuehne-nagel.com

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_013_off0000a04c.bin` `291130d6ca1a9c2c0c8802497d7df30a1f5a18b12575647c60a39d6a048c9773`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xA04C	35012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.