Malicious PDF — malware analysis report

Static analysis result for SHA-256 229aabe71fd9f341…

MALICIOUS

PDF

44.4 KB Created: 2021-05-16 22:55:17 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 210914dd4e49ee021201c5f723a4a63a SHA-1: 1cb92ad301ed8e98ba5d67d70cec6753100b5eab SHA-256: 229aabe71fd9f341282405324006c38a5261b7ee87011b59177b31b626526620
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a visual call-to-action, indicating an attempt to trick users into downloading further malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple links to potentially malicious PDF files reinforces this assessment. The document's content and embedded links suggest a phishing or scam attempt, likely related to in-game items or currency.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9648

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-roblox-outfits-game-hack PDF link annotation
    • http://118.174.0.244/UserFiles/File/coin-master-daily_GM406889139.pdfPDF link annotation
    • http://118.174.0.244/UserFiles/File/roblox-free-item-codes_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/how-to-get-free-robux-website_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/earn-robux-for-roblox_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/coin-master-free-spin-codes_GM406889139.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/roblox-hacks-com_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/robux-adder_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/avatar-de-roblox_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/coin-master-hack-tool-2021_GM406889139.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/coin-master-hack-xyz_GM406889139.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/coin-master-free-spin-link-today-2021_GM406889139.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/free-roblox-clothes-2021_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/free-roblox-accounts-with-robux-that-work-not-banned_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/robux-hacks-2021_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/how-to-make-free-robux_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/free-spin-coin-master-today_GM406889139.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/free-roblox-com_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/free-robux-hacks-no-verification_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/roblox-studio-free-robux_GM431946152.pdfIn PDF document text
    • http://118.174.0.244/UserFiles/File/minecraft-that-you-can-play-for-free_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004874.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4874 24524 bytes
SHA-256: ec55098b7a046b994696d568909a8863ae18114ae734d6d3acddade6fc8dc7b4
font_01_sfnt_off00008091.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8091 2940 bytes
SHA-256: eb230542719c96b42e3fd8bb01e35f13ebd5f02629049da3a58e7fd7607bf48a
font_02_sfnt_off00008aa0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8AA0 18312 bytes
SHA-256: 90da43312d6bb992ca5b038b2bc6e2b12c2c9d98bca064d3c60a0cee32c74c59

Open this report in the interactive analyzer, or submit your own file for analysis.