Malicious PDF — malware analysis report

Static analysis result for SHA-256 fda30bc59a1495ac…

MALICIOUS

PDF

118.6 KB Created: 2022-06-08 14:41:27 Authoring application: Property Sale Deed Agreement preps (via FPDF 1.82) First seen: 2022-07-15
MD5: 8247fcbf7aad47f0a3adb95405435400 SHA-1: bbc55d403ab80bf905ae52e871597acc665dbd07 SHA-256: fda30bc59a1495ac011ca3fa542cd5aba01f031da0e69860b80c893a8000b44b
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document employs an advance-fee scam lure, attempting to deceive users with language related to property sales and funds. It contains multiple invisible and payload links pointing to the domain 'eminemreactor.site', which likely serve to deliver a secondary malicious payload. The heuristic firings strongly indicate a social engineering attack aimed at defrauding the user.

Machine Learning

  • Nyx PDF Classifier clean score 0.0025

Heuristics 3

  • Invisible/repeated PDF links deliver payload file critical PDF_REPEATED_PAYLOAD_LINK_LURE
    PDF uses invisible link annotations and points to a direct payload download. Repeated invisible links or lure-like payload names such as document/unlock/verify archives match malware-delivery PDF carriers where the page is only a prompt and the real payload is fetched from the linked URL.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eminemreactor.site/Property-Sale-Deed-Agreement/pdf/www.marklittler.com
    • http://eminemreactor.site/Property-Sale-Deed-Agreement/doc/www.marklittler.com
    • https://www.marklittler.com/wp-content/uploads/formidable/16/sample-employee-survey-questions.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/google-spreadsheet-writing-height-of-a-person.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/wakefield-and-associates-summons.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/cesr-guidance-inside-information.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/miller-function-and-participation-scales-manual-pdf.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/british-airways-london-to-sydney-direct.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/cathedral-seville-audio-guide.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/create-an-invoice-template-in-xero.pdf
    • https://www.marklittler.com/wp-content/uploads/formidable/16/car-repair-agreement-letter.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_025_off0001cde2.bin
43b13684882d332187dbe2691d5e4f64c33a98e381a4dc2316374ba1b923b47c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1CDE2 76950 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.