PDF malware analysis — malicious · f895505fa6c0b603

MALICIOUS

PDF

105.7 KB Created: 2022-06-23 15:39:30 Authoring application: Xero Where Are The Saved Invoices klass (via FPDF 1.82) First seen: 2022-07-15

MD5: d94832ee803b5cb29b65cdf1a7e7d870 SHA-1: 84a339bff72b366e49f1564ffbf825cbd7276d29 SHA-256: f895505fa6c0b60304df9213eac674c5a49f4d132ef3ce898378408ad314872c

70 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains multiple invisible and repeated links, a common tactic for luring users into downloading malicious payloads. The document body and embedded URLs suggest a fake invoice or payment lure. The primary malicious URL identified is http://starkave.site/Xero-Where-Are-The-Saved-Invoices/pdf/www.aquilatrucks.com, which likely hosts the secondary stage payload.

Machine Learning

Nyx PDF Classifier clean score 0.0007

Heuristics 3

Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE

PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://starkave.site/Xero-Where-Are-The-Saved-Invoices/pdf/www.aquilatrucks.com
- http://starkave.site/Xero-Where-Are-The-Saved-Invoices/doc/www.aquilatrucks.com
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/austin-accident-reports-online.pdf
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/devis-assurance-voiture-sans-permis-axa.pdf
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/whats-a-literary-term.pdf
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/affordable-superintendant-letter-programs.pdf
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/zong-good-night-offer-details.pdf
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/nc-striped-bass-proclamation.pdf
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/the-league-of-nations-worksheet-answers.pdf
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/letter-of-support-for-medicaid-application.pdf
- https://www.aquilatrucks.com/wp-content/uploads/formidable/168/sesame-street-letter-in-the-pool.pdf

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off000014b0.js` `a235476400b1fdd4ebbda15c9778504c8465cc26a5cd78dd2ce06246a3ad4449`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x14B0	2747 bytes
`stream_008_off00002f5f.js` `5f4e9e7eed13adae049a30512a734609f1a376faee271ac2b0de187ad3d091fb`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x2F5F	3288 bytes
`stream_016_off00019b58.bin` `43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x19B58	76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.