Malicious PDF — malware analysis report

Static analysis result for SHA-256 113fb600dad189fc…

MALICIOUS

PDF

35.7 KB Created: 2021-07-09 23:37:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 77ba287a0142b6605090b35513f9ce6b SHA-1: 51361d3d46ce200d128ab6ec65ea73b0c9f570d7 SHA-256: 113fb600dad189fc9dced49ad96b2768d49c7289048e525481dc405d7dcfa7a5
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains embedded URLs and a call-to-action phrase, suggesting a lure for users to download a malicious payload. The ML classifier strongly flagged this PDF as malicious, and the presence of a password archive lure heuristic indicates an attempt to bypass security controls. The primary URL http://netcdn.tw/app/406889139/coin-master-hack-xyz-2021-game-hack is likely the distribution point for the secondary stage.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-hack-xyz-2021-game-hack
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/daily-coin-master-link_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-free-coins-and-spins-online-tool_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/minecraft-114-download_GM479516143.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/flip-master-free-coins_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/robux-hack-tools_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-online-hack-link_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/hacks-para-pet-simulator-roblox_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/animation-free-roblox_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-and-coins-daily-links_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/pubg-mobile-uc-xyz_GM1330123889.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/getbux-me-free-robux_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-tiktok-coins_GM835599320.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux-2021_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-robux-generator-no-human-verification_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux-without-downloading-any-apps_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/roblox-free-pets_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/spin-links-for-coin-master_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux-not-a-scam_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-100-free-spins-link_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/rbx-codes-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032af.bin
618b9d5c82d5e0934c49a17420498ff024576e56e5f8a7cfedc6e9a1cd7647d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32AF 23348 bytes
font_01_sfnt_off000066a3.bin
6196b08645be86931896c29a7b8527461e4ee1bb55985642a652b484aa03a2ea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66A3 18896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.