Malicious PDF — malware analysis report

Static analysis result for SHA-256 30cc67fdf996f952…

MALICIOUS

PDF

45.9 KB Created: 2021-05-16 03:00:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 21b3dc0f75d501ff21307ff43460f67e SHA-1: acb0028269982e166091441a098001dcd059f2bf SHA-256: 30cc67fdf996f952a63381708fd45bd6b3cc0f5783e357df6adf7d30bdea19b5
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple links that are identified as lures for game hacks and free currency, such as 'how-to-get-free-robux-youtube-game-hack'. These links likely redirect to malicious sites designed to trick users into downloading further malware or revealing personal information. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9432

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-get-free-robux-youtube-game-hack PDF link annotation
    • http://ivalor.fr/images/free-robux-no-verify_GM431946152.pdfIn PDF document text
    • http://ivalor.fr/images/android-coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/is-coin-master-free_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/coin-master-spin-link-free-download_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/i-got-hacked-on-roblox_GM431946152.pdfIn PDF document text
    • http://ivalor.fr/images/coin-master-coins-free_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/coin-master-hack-tool-2021_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/free-robux-real-working_GM431946152.pdfIn PDF document text
    • http://ivalor.fr/images/minecraft-gun-mod-download-free_GM479516143.pdfIn PDF document text
    • http://ivalor.fr/images/free-spins-coin-master-links-2021_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/rbl-gg-free-robux_GM431946152.pdfIn PDF document text
    • http://ivalor.fr/images/cute-free-roblox-clothes_GM431946152.pdfIn PDF document text
    • http://ivalor.fr/images/daily-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/free-robux-without-offers_GM431946152.pdfIn PDF document text
    • http://ivalor.fr/images/roblox-free-robux-com_GM431946152.pdfIn PDF document text
    • http://ivalor.fr/images/coin-master-free-stars_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/minecraft-tower-defense-2-hacked_GM479516143.pdfIn PDF document text
    • http://ivalor.fr/images/minecraft-free-download-mac_GM479516143.pdfIn PDF document text
    • http://ivalor.fr/images/coin-master-connection-lost-hack_GM406889139.pdfIn PDF document text
    • http://ivalor.fr/images/spin-free-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004958.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4958 27124 bytes
SHA-256: 6d9fb9cf316edeb099473d4ab3330185eb02d6c6636d5a0ed70d151486691333
font_01_sfnt_off000086ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x86AD 2824 bytes
SHA-256: 45bf821f81e84f4aa8d8374f492b182b36404f38b462c7dc471deaad6ab5c104
font_02_sfnt_off0000905a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x905A 18444 bytes
SHA-256: c8869677d4d84c4518e8410e1128de6ae04a76f8db213e07b668dd1668cda2fe

Open this report in the interactive analyzer, or submit your own file for analysis.