Malicious PDF — malware analysis report

Static analysis result for SHA-256 70b5de2b797fd797…

MALICIOUS

PDF

57.7 KB Created: 2020-11-03 07:26:24 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-10-26
MD5: 85f9ef0f8c8885780c6e847fd68e66f1 SHA-1: 7305d8bd86f965cceeb1fdc803a3c491374b2648 SHA-256: 70b5de2b797fd797af94c8695e535e02279f6497503e5532ba9817c6cfa8d7ab
182 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains embedded links that redirect to malicious infrastructure, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The ML classifier also strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains URLs that are consistent with brand impersonation for credential phishing, specifically USPS. The presence of these links suggests the document's primary purpose is to trick the user into navigating to a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Brand-impersonation credential phishing lure critical SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: action link to abused redirector https://voxapinave.weebly.com/uploads/1/3/2/7/132740917/d02ddf7836b.pdf.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.com/123?keyword=the+americas+pdf+textbook In PDF document text
    • https://voxapinave.weebly.com/uploads/1/3/2/7/132740917/d02ddf7836b.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4369499/normal_5f8d30647e2f5.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4371267/normal_5f924458cd7a8.pdfIn PDF document text
    • https://mumixopid.weebly.com/uploads/1/3/1/8/131872042/fobesesajet.pdfIn PDF document text
    • https://semezuzuxikazug.weebly.com/uploads/1/3/4/2/134234688/311e3498cd37.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370057/normal_5f89ea243fdc3.pdfIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.daltonmaag.com/In PDF document text
    • https://s3.amazonaws.com/wupiwupiwot/windows_8_activator_key.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/77bb3659-249c-4abc-8bb5-b433210e33f4/38278979136.pdfIn PDF document text
    • https://s3.amazonaws.com/bepukuba/paramphistomum_en_bovinos.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/1e12306d-27fc-4e3b-8280-54377613d301/80s_music_quiz_questions_and_answers.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00008016.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8016 13240 bytes
SHA-256: ed0c633f5403d0b35c8f75a0376d028744950fd9f3f17d0420476244d3c1c61f
font_00_sfnt_off00006e41.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E41 5264 bytes
SHA-256: a1c142a9cdf72bdd61ed22313822fc2ca554937109e9d2ea64e393eb86be22f9
font_02_sfnt_off0000a551.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA551 11364 bytes
SHA-256: eb37b6824096983bbb95ed618078b686d310b70c4fa70ec373db0d1ef20636dd
font_03_sfnt_off0000cbc5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCBC5 4324 bytes
SHA-256: 9f355172d696dda274cac500966718f112ce76951f19577ac4888987ea6471b2

Open this report in the interactive analyzer, or submit your own file for analysis.