Malicious PDF — malware analysis report

Static analysis result for SHA-256 08f9d8964a1cd92a…

MALICIOUS

PDF

45.9 KB Created: 2021-05-15 00:32:43 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 4af9b3f953a672dc6bf98ec33c8835be SHA-1: 005b54f0d0d6944a922f6cfe508de0998b3794ed SHA-256: 08f9d8964a1cd92a7cd40b4e112c1aad3b134111366db9ac36c7d69c9a2418c1
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF document contains a lure for 'Free Spins On Coin Master 2021' and impersonates the Facebook brand to encourage users to click a malicious link. The primary link, https://netcdn.xyz/app/406889139/get-free-spins-on-coin-master-2021-game-hack, is hosted on a domain unrelated to the impersonated brand, indicating a credential phishing attempt. While no scripts were explicitly extracted, the PDF structure and embedded links suggest a malicious workflow designed to trick users into visiting a potentially harmful site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9432

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://netcdn.xyz/app/406889139/get-free-spins-on-coin-master-2021-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/get-free-spins-on-coin-master-2021-game-hack PDF link annotation
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/coin-master-400-spin-link-hack_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/free-roblox-dominus_GM431946152.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/free-spins-and-coins-coin-master-app_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/robux-gift-card-free_GM431946152.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/coin-master-hack-september-2021_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/coin-master-apk-hack-32_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/roblox-free-clothes-codes_GM431946152.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/hack-coin-master-pc_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/how-to-get-spins-on-coin-master-hack_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/7-year-old-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/coin-master-hack-version-download-2021-android_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/earn-free-robux-today_GM431946152.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/robux-page_GM431946152.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/how-do-you-earn-free-coins-for-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/coin-master-free-generator_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/free-coins-and-spins-in-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/how-to-earn-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/robux-free-gift-card-org-hack_GM431946152.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/master-coin-free-spin-daily_GM406889139.pdfIn PDF document text
    • https://elearning.mtsnsamarinda.sch.id/__statics/gudangsoal/files/coin-master-free-spins-link-2021_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004ce3.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4CE3 24972 bytes
SHA-256: af762c4dba0496d87cc7c44857b6d0b246a9345ba22154dba05264dd495001f0
font_01_sfnt_off000086d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x86D0 2880 bytes
SHA-256: 10d025f04f706eb71cdda4f99784df1b9ccb52e48080e43095e0398eaef6f132
font_02_sfnt_off000090bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x90BB 18288 bytes
SHA-256: 51edae499e96af11139ef94313efcbf906f73cd888d739ca20624da83f1b55af

Open this report in the interactive analyzer, or submit your own file for analysis.