Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e1df51f15e50380…

MALICIOUS

PDF

39.8 KB Created: 2021-05-21 05:07:50 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 2837f0ff13de5924eb6b105a72cacfb8 SHA-1: 27e05c090dff095266911601cef7cc0be21c2a3f SHA-256: 1e1df51f15e50380b6fb958fe3d14b973524215d7bd202d4cb3742a81012c8cc
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a prominent call-to-action to download a game hack, indicating a phishing or malware distribution attempt. The ML classifier also flagged the document as malicious. The presence of external URIs and download lures strongly suggests an attempt to trick the user into downloading a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8060

Heuristics 4

  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-free-download-unblocked-game-hack PDF link annotation
    • http://moto98.com/images/coin-master-card-hack-2021_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/minecraft-online-free-download_GM479516143.pdfIn PDF document text
    • http://moto98.com/images/coin-master-free-coins-and-spins-link-2021_GM406889139.pdfIn PDF document text
    • http://moto98.com/images/how-to-hack-roblox_GM431946152.pdfIn PDF document text
    • http://moto98.com/images/free-coins-for-planet-master-game_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000339b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x339B 25408 bytes
SHA-256: c577858e587ca6964b12e0e090e41c0ec39d42b3bf43abe31b986e2b388cd491
font_01_sfnt_off00006de6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DE6 3056 bytes
SHA-256: dd24a0ab94df4552e459bd06fd01b0fd3f021c1d51d1d64407070e735974a028
font_02_sfnt_off00007858.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7858 18804 bytes
SHA-256: 351b73efa1cf4358b07b283040b01ec481d6b0b50516ad4f4e94e13994b713ed

Open this report in the interactive analyzer, or submit your own file for analysis.