Malicious PDF — malware analysis report

Static analysis result for SHA-256 1cc610396f39fdc9…

MALICIOUS

PDF

36.9 KB Created: 2021-05-20 14:44:56 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: f161bfa16898f70c56a809a6c692d4d1 SHA-1: c429c9202df61fe2dc8bea1c2f2ff80ef07f6d0f SHA-256: 1cc610396f39fdc996e5cf1b09d7ccb1d66445e54402a67ebabb93a990fa804c
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document body and extracted URLs indicate a lure for a "Coin Master Hack" and related game cheats, which is a common social engineering tactic. The heuristic 'SE_SECRET_RECOVERY_LURE' further suggests the document may attempt to trick users into revealing sensitive information like private keys or passwords. While no scripts were explicitly extracted, the PDF structure and embedded URIs suggest potential for malicious JavaScript execution or redirection to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9447

Heuristics 4

  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-hack-no-survey-or-verification-game-hack PDF link annotation
    • https://hekl-software.de/images/free-robux-gift-card-generator_GM431946152.pdfIn PDF document text
    • https://hekl-software.de/images/is-it-possible-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://hekl-software.de/images/roblox-com-games-referrer-roblox-player_GM431946152.pdfIn PDF document text
    • https://hekl-software.de/images/free-coin-master-spins-for-today_GM406889139.pdfIn PDF document text
    • https://hekl-software.de/images/free-daily-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003472.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3472 25152 bytes
SHA-256: a55e8e51915a2d36fb545ca27b55122697daeedf0a78079cc72c87737dd84ce4
font_01_sfnt_off00006ea8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EA8 18284 bytes
SHA-256: 11bfbc115034705528bf6e10e44e61aa29d499e253164c4385166f501b43b311

Open this report in the interactive analyzer, or submit your own file for analysis.