Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a352adbea5078aa…

MALICIOUS

PDF

49.9 KB Created: 2021-06-13 17:18:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 05a2eb90c92f876828a8796837f6ef36 SHA-1: 7c5d70926642d183f8d5765d2a6b037f2c64e380 SHA-256: 1a352adbea5078aa707d48e4e683e8121df71b2a9ee7304739d40962a27528d1
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a primary URL in the document body, all pointing to sites offering game hacks or cheats. The ML classifier strongly flagged this PDF as malicious, and heuristics indicate it uses urgency and a call-to-action button to encourage downloads. The document also suggests a password-protected archive, a common tactic to evade security scanning.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 5

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-free-xynapse-x-game-hack PDF link annotation
    • http://library.yamasi.ac.id/repository/roblox-free-robux-game-no-password_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/coin-master-free-pet-food-links_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/is-there-any-way-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/roblox-hacks-mas-fuertes_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id//repository/how-can-i-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/free-robux-hack_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id//repository/free-roblox-cards-pin-number_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/robux-2021_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/change-roblox-username-free_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id//repository/coin-master-free-spins-and-coins-2021_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/azure-mines-free-copy-roblox_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/tiktok-free-search_GM835599320.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/roblox-free-domino-crown-promo-code_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/coin-master-free-spin-daily-link_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/roblox-sprinting-simulator-hack-2021_GM431946152.pdfIn PDF document text
    • http://library.yamasi.ac.id//repository/free-minecraft-premium-account_GM479516143.pdfIn PDF document text
    • http://library.yamasi.ac.id//repository/free-spins-october-28-2021-coin-master_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/minecraft-mojang-free_GM479516143.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://library.yamasi.ac.id/repository/coin-master-free-cards-link-2021_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005018.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5018 29324 bytes
SHA-256: a823d1f62798591fd5524c9bfda9e9beb50f9dc3dbbcc2c640b927faaa9a1e2a
font_01_sfnt_off000092dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x92DC 3884 bytes
SHA-256: 40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf
font_02_sfnt_off00009f84.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9F84 18532 bytes
SHA-256: 0c956edd96a68c2f757742de28570f114356e481a10a38a0241abc941ee924a7

Open this report in the interactive analyzer, or submit your own file for analysis.