Malicious PDF — malware analysis report

Static analysis result for SHA-256 27c8e22092c73c55…

MALICIOUS

PDF

34.6 KB Created: 2021-06-26 00:24:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 4099f5487f8424ec17068ed95cda4122 SHA-1: cf81fa67c6d4691d1b86cc8eee7d49e00e4f1fc0 SHA-256: 27c8e22092c73c55d32c777be438eeb0b60b4a91ad67c0bdccd80c6889dcaec5
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains multiple embedded URLs and a call-to-action phrase, strongly suggesting a lure to download malicious or unwanted software related to game hacks. The ML classifier also flagged this PDF with high confidence. While no scripts were directly extracted, the embedded URLs point to domains hosting executables or further malicious content, likely intended to exploit vulnerabilities or trick users into execution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/has-momo-hack-roblox-game-hack PDF link annotation
    • https://domc.tw/upload/files/free-2021-robux_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/hackear-coin-master-espaol_GM406889139.pdfIn PDF document text
    • https://domc.tw/upload/files/coin-master-free-spins-link-2021-haktuts_GM406889139.pdfIn PDF document text
    • https://domc.tw/upload/files/tryrbx-site-free-robux_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/free-spin-link-for-coin-master-game_GM406889139.pdfIn PDF document text
    • https://domc.tw/upload/files/harked-roblox-hack_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/toolbox-for-minecraft-pe_GM479516143.pdfIn PDF document text
    • https://domc.tw/upload/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/free-robux-clothes_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/send-me-500-2021-spins_GM406889139.pdfIn PDF document text
    • https://domc.tw/upload/files/free-roblox-generator_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/how-to-coin-master-spin-hack_GM406889139.pdfIn PDF document text
    • https://domc.tw/upload/files/free-robux-real-real_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/how-to-get-free-coins-on-tiktok_GM835599320.pdfIn PDF document text
    • https://domc.tw/upload/files/get-free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • https://domc.tw/upload/files/free-robux-gift-card-generator_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/get-free-robux-generator_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/is-roblox-free-on-ps4_GM431946152.pdfIn PDF document text
    • https://domc.tw/upload/files/best-free-spin-app-for-coin-master_GM406889139.pdfIn PDF document text
    • https://domc.tw/upload/files/how-to-record-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000301b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x301B 22480 bytes
SHA-256: 6f8f89fc098d5b34d8af9b946f2918ced4c5c4dfe48469b71ae9b25d15abdcfd
font_01_sfnt_off00006232.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6232 19112 bytes
SHA-256: fa79ef4a6333d1b46bfdad07f8d1975489f2bc6b655e8e5b9345b5f1fcb4d2aa

Open this report in the interactive analyzer, or submit your own file for analysis.