Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c27694514d7df3a…

MALICIOUS

PDF

32.2 KB Created: 2021-07-20 22:06:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6457bcfff6d40c17fcb5e8129c4f5184 SHA-1: 5167f3feae670b56fb119ee86d97a9d780b5eb65 SHA-256: 1c27694514d7df3a5e6e1498b6204befd608659e0e9008820d96a78a517fabdb
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs that redirect to websites offering game hacks and generators, a common lure for malware distribution. The ML classifier strongly indicated maliciousness, and the document body, though partially corrupted, contains references to these lures and external URLs. No scripts were extracted, but the overall pattern suggests a phishing or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9900

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/minecraft-realms-free-game-hack PDF link annotation
    • http://perpustakaan.akper-serulingmas.ac.id/repository/minecraft-gun-games-free_GM479516143.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/blox-land-free-robux_GM431946152.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/free-robux-codes-2021-not-used_GM431946152.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/how-to-get-free-robux-without-human-verification_GM431946152.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/free-tiktok-followers-no-human-verification_GM835599320.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/coin-master-daily-free-spins-link-today_GM406889139.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/minecraft-redeem-code-free_GM479516143.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/minecraft-bedrock-edition-free_GM479516143.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/coin-master-daily-free-spins-link-app_GM406889139.pdfIn PDF document text
    • http://perpustakaan.akper-serulingmas.ac.id/repository/robuxlove-net-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e2f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E2F 21532 bytes
SHA-256: 0a466332cf8ff750a35ce79d10b79fed1f385a1582afd8f23147dab82c3bdb30
font_01_sfnt_off00005d1d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D1D 17900 bytes
SHA-256: badbc394cd8954733b164be5cc8c6ff402afbb9d7774d644eb4a8191a91f4c18

Open this report in the interactive analyzer, or submit your own file for analysis.