Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c93ab00f235b737…

MALICIOUS

PDF

53.3 KB Created: 2021-05-11 04:07:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-23
MD5: 47fe92d570d5ff20c93dc4042087ef93 SHA-1: 71749110af7e3d509b29cc5a42bf674932751465 SHA-256: 1c93ab00f235b737150d9ca48a943161678bf2ea2c07cc8b632f0ebe65229507
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains embedded URLs that lead to known malicious redirector infrastructure, specifically targeting users interested in game hacks and cheats. The ML classifier also flagged this PDF as malicious. The document body, though obfuscated, contains references to game-related content and URLs, reinforcing the lure for users to click on malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9017

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-1.15-2-hacks-game-hack In PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/how-to-hack-someones-roblox-account_GM431946152.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/coin-master-tips_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/wahoogaming-co-free-robux_GM431946152.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/haktuts-coin-master-free-spin-link-today_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/free-robux-no-download_GM431946152.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/best-site-for-free-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/free-robux-site_GM431946152.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/hacks-for-roblox-jailbreak_GM431946152.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/coin-master-hack-tool-v1-9-apk_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/get-free-robux-2021_GM431946152.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/minecraft-app-free-download_GM479516143.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/coin-spin_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/coin-master-links-free-spins_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/levvvel-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/coin-master-free-spins-link-2021_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/www-roblox-com-robux_GM431946152.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/how-can-i-get-free-robux_GM431946152.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/free-spins-link-in-coin-master-2021_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/coin-master-free-spins-link-2021-today_GM406889139.pdfIn PDF document text
    • https://elearning-mtsn3jkt.com/__statics/gudangsoal/files/how-to-get-800-robux-for-free_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004cbf.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4CBF 25468 bytes
SHA-256: 1ee569c29047f04b6dce1432fcd8f2b32a3f2b724ffa3e15227ab9519dbf2eea
font_01_sfnt_off000085fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x85FD 8136 bytes
SHA-256: df586c02584bba8dbcfbf968e47555033873c6b6a30e63539cc350cae8b72960
font_02_sfnt_off00009fd1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9FD1 4232 bytes
SHA-256: ab6320ab342704d2c5943abfba82ed4837bf2da871c91621741fd4cfd15c6ed5
font_03_sfnt_off0000ae5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAE5D 18168 bytes
SHA-256: db08b96da71f6ddfbe6b519ed50ce659f2c78f4173f4a3128d613ddf1b801d62

Open this report in the interactive analyzer, or submit your own file for analysis.