Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e4490d4ed863147…

MALICIOUS

PDF

46.1 KB Created: 2021-06-03 22:40:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 8706891a5ab7bbdbae61b3281b0281cc SHA-1: c0599688dcab4a60c61f089681fa70d6815752db SHA-256: 1e4490d4ed8631470caf29a92f7c0460194eb523827eac77fd105e7b93723016
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a link that redirects to a "free generator / game hack" lure, indicating a phishing or scam attempt. The ML classifier also flagged this PDF as malicious. While no scripts were directly extracted, the presence of embedded URLs and the nature of the lure suggest an attempt to direct the user to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9797

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/406889139/coin-master-free-download-game-hack PDF link annotation
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/free-robux-com-real_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/how-to-download-minecraft-for-free-on-iphone_GM479516143.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/how-do-u-get-robux_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/krnl-download_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/free-100-robux_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/lastrick-com-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/robloxfun-com-generator_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-without-offers_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/fb-coin-master-free-spins-link_GM406889139.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/free-roblox-executor_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/get-free-roblox_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/hack-coin-master-game_GM406889139.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/coin-master-32-hack-apk-download_GM406889139.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/spin-free-coin-master_GM406889139.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/coin-master-free-cards_GM406889139.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/how-to-get-roblox-premium-for-free-2021_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/coin-master-free-daily-spins_GM406889139.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/www-robux-redeem_GM431946152.pdfIn PDF document text
    • http://elearning.man1metro.sch.id/__statics/gudangsoal/files/coin-master-latest-mod-apk-free-download_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00004f97.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4F97 24324 bytes
SHA-256: 560af2209a2c8b9c65e24e8e1f29fb1b9eb2432ede470b23d2d960c4a1beaefa
font_01_sfnt_off00008780.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8780 2840 bytes
SHA-256: 3fb127b764b9d10f5525bc4de5ec8316de704409ccb0cf21cff3ad8a30d11676
font_02_sfnt_off00009131.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9131 18292 bytes
SHA-256: 1420c55b4555a3c93edfa38397747ee720807b137973850ab9437a8daa1aea65

Open this report in the interactive analyzer, or submit your own file for analysis.