Malicious PDF — malware analysis report

Static analysis result for SHA-256 02eccbbc5a6d1cb8…

MALICIOUS

PDF

75.0 KB Created: 2020-12-18 17:34:51 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-14
MD5: 93f0d6b2759cb54577b329c27ed20d7e SHA-1: e6253b739f797603c150e21701509bdf5cdfe0b0 SHA-256: 02eccbbc5a6d1cb8a5a970b727de7f406b167be35717b03ab2540374c6e77e9c
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains an embedded URL that directs users to a suspicious domain, likely for phishing or to download a secondary payload. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, references 'freddy fazbear's pizza', a common lure in phishing campaigns.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://trafffe.ru/strik?utm_term=directions+to+freddy+fazbear%2527s+pizza PDF link annotation
    • https://cdn-cms.f-static.net/uploads/4391636/normal_5fb27de1a8d7a.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4374983/normal_5f901769c3a04.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4370280/normal_5f8d4b191918c.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4469645/normal_5fa5c0111cea2.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4381104/normal_5f9088ceaa2c1.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4471682/normal_5fc35f08ca012.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/6789f761-07aa-4e42-ab9b-8279a941c0ce/area_code_629_country_band.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fc0e110403f5353fd95a22f/t/5fc31e295147b14804997ee0/1606622762148/detexadulotovufofuguzek.pdfIn PDF document text
    • https://static1.squarespace.com/static/5fbffea5239b0722912c2f3a/t/5fc0e8004e98326c02318a5d/1606477832394/kenanurizirizezin.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/9ea13d43-ea4a-4801-bcbd-0f119cd1b571/97343014575.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/6453f1f4-a091-497d-9d33-2dc2550b6b21/9046685709.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/4c700cd6-48de-407f-b0ba-c21eb43e870f/lifetime_fitness_sandy_springs.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e0f2dc8f-5793-459f-83d1-42f249eb5e09/kimijiseg.pdfIn PDF document text
    • https://s3.amazonaws.com/zamemigojat/17421977790.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c2fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC2FB 5440 bytes
SHA-256: 28e86545f677116c65e6a6b8b44030df914a832ebddf9e91ffdf72d2e075ca4b
font_01_sfnt_off0000d59c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD59C 3484 bytes
SHA-256: be2e3595ff4efc4ae89d0d533636aeb5852c9803a6a4740b0821b40a29a9485d
font_02_sfnt_off0000e2eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE2EB 10656 bytes
SHA-256: 2c53d8989f127d1e7b783d3184a94e926ce4b95a3b61d02bd2c2da8a1888a2e2
font_03_sfnt_off000107ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x107AC 16776 bytes
SHA-256: c2a865d708549b841659570ea6e73f8006d6fd3e09f94ec4475fdccf270ee2f6

Open this report in the interactive analyzer, or submit your own file for analysis.