Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b7ecef4f43ae4b2…

MALICIOUS

PDF

34.1 KB Created: 2021-07-01 12:48:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 1522f722847b6a4c6575f41dd79e07c1 SHA-1: 636f4926ed1eed67e57d2f2af0d6bfe20580e876 SHA-256: 1b7ecef4f43ae4b24df215c0f765d8b23724be87d7e3b3c93506264b4abf55a2
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents itself as a guide to hacking online game accounts, a common social engineering lure. It contains a prominent link to an external URL, likely leading to a payload download. The heuristic 'SE_BROWSER_INSTALL_LURE' further suggests the document aims to trick the user into installing something potentially malicious by masquerading as a necessary update or tool.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/hack-anyone PDF link annotation
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/100-hack-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/free-roblox-accounts-not-banned_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/how-to-get-20210-robux-on-roblox-2021-for-free_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/how-to-use-free-robux-cheat-codes_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/hack-roblox-free-admin_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/classic-minecraft-net-hacks_GM479516143.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/coin-master-spin-link-today_GM406889139.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/free-coins-coin-master-spins_GM406889139.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/100-free-roblox-templates_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/gete-free-robux_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/hack-crack-for-coin-master-currency_GM406889139.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/roblox-is-free-to-play_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/coin-master-heaven-links-free-spins_GM406889139.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/how-to-get-btools-from-cheat-engine-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/roblox-games-that-give-you-free-items_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/roblox-free-robux-com_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/free-20210-robux_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/how-to-get-admin-commands-on-roblox-jailbreak-free_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/free-robux-kid-friendly-no-human-verification_GM431946152.pdfIn PDF document text
    • https://elearning.alhurriyah1.sch.id/__statics/gudangsoal/files/earn-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F5D 21552 bytes
SHA-256: 1c3c1f08f5f77908302b3347b0c75f3afd3ccf2895effaef495fe91febbf40c3
font_01_sfnt_off00005e64.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E64 19544 bytes
SHA-256: 117866cb0bb2bb328f499f7b678ee1b03ec61b83a77218dc1920a45dd787e984

Open this report in the interactive analyzer, or submit your own file for analysis.