Malicious PDF — malware analysis report

Static analysis result for SHA-256 2df50fd6e7ff03f8…

MALICIOUS

PDF

36.0 KB Created: 2021-06-18 16:34:19 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 9e15197b0295feb2a208d0de2da89f64 SHA-1: 816f46e3b4e9db9feb8dbb17294a2962e1358ccf SHA-256: 2df50fd6e7ff03f8c2a4034b2f7249ec876ce9bc62e3dff570ccc362196d715a
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a high-risk heuristic firing for a 'game hack' lure, directing users to an external URL. The document body and embedded URLs reinforce this theme, promoting free downloads and hacks for popular games like Roblox and Minecraft. The ML classifier also strongly indicated maliciousness. The primary attack vector appears to be social engineering via a malicious attachment, leading users to a potentially harmful website.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-free-download-no-sign-up-game-hack PDF link annotation
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/how-to-get-more-robux-for-free_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/roblox-executor-free-download_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/minecraft-ps4-free_GM479516143.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/robux-rewards_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/how-do-i-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/coin-master-new-cards-hack_GM406889139.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/robloxheroxyz-free-robux_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/best-minecraft-hacks_GM479516143.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/minecraft-free-ios-2021_GM479516143.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/coin-master-free-spin-link-app_GM406889139.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/free-spin-coin-master-link-2021_GM406889139.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/is-minecraft-free-on-computer_GM479516143.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/robux-free-online_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/minecraft-windows-10-free-with-java_GM479516143.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/coin-master-free-spins-youthnow_GM406889139.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/free-roblox-clothes-templates_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/free-robux-scams_GM431946152.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/minecraft-for-ps3-free_GM479516143.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/coin-master-free-spins-apk-2021_GM406889139.pdfIn PDF document text
    • https://e-learning.mtsnegeri1ende.sch.id/__statics/gudangsoal/files/free-spins-coin-master-links_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33EA 22524 bytes
SHA-256: 923490b1f94adfcb7b1ac5d2f54a16242ae13437d8ebd3bfe1fd56f076854373
font_01_sfnt_off00006672.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6672 19452 bytes
SHA-256: 8e83d216f1d2baff05c7f0fde77fb6a58d6abdf7830379119bfdebad511036e5

Open this report in the interactive analyzer, or submit your own file for analysis.