Malicious PDF — malware analysis report

Static analysis result for SHA-256 32b071c678ca7b63…

MALICIOUS

PDF

47.0 KB Created: 2021-06-04 04:30:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 376d71737af78c799b6cbab1de1b0423 SHA-1: 1b44df9f364afbbbd6ddf416c9c08b877807f65a SHA-256: 32b071c678ca7b63764225d441b9c99a15bac78553b1d7e399e66731fca812ed
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document employs a lure related to free Minecraft hacks and games, directing users to download potentially malicious content from external URLs. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded URLs and a call-to-action button further supports a malicious intent to trick users into downloading malware. The document also contains heuristics indicating it might be part of a password-protected archive lure, suggesting an attempt to bypass security scanning.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9769

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/479516143/try-minecraft-free-game-hack
    • http://abdinusababellibrary.ac.id//repository/roblox-free-roblox_GM431946152.pdf
    • http://abdinusababellibrary.ac.id//repository/best-minecraft-hacked-client-2021_GM479516143.pdf
    • http://abdinusababellibrary.ac.id//repository/how-to-make-free-robux_GM431946152.pdf
    • http://abdinusababellibrary.ac.id//repository/minecraft-free-ios-no-verification_GM479516143.pdf
    • http://abdinusababellibrary.ac.id//repository/free-minecraft-account_GM479516143.pdf
    • http://abdinusababellibrary.ac.id//repository/free-robux-website_GM431946152.pdf
    • http://abdinusababellibrary.ac.id//repository/how-to-get-free-robux-codes_GM431946152.pdf
    • http://abdinusababellibrary.ac.id//repository/coinmaster-hack_GM406889139.pdf
    • http://abdinusababellibrary.ac.id//repository/free-robux-that-actually-works_GM431946152.pdf
    • http://abdinusababellibrary.ac.id//repository/free-roblox-hair-boy_GM431946152.pdf
    • http://abdinusababellibrary.ac.id/repository/tiktok-likes-free_GM835599320.pdf
    • http://abdinusababellibrary.ac.id//repository/spin-links-for-coin-master_GM406889139.pdf
    • http://abdinusababellibrary.ac.id//repository/coin-master-gold-cards-free_GM406889139.pdf
    • http://abdinusababellibrary.ac.id//repository/free-minecraft-hosting_GM479516143.pdf
    • http://abdinusababellibrary.ac.id//repository/robuxy-com-free-robux_GM431946152.pdf
    • http://abdinusababellibrary.ac.id//repository/best-way-to-get-free-robux_GM431946152.pdf
    • http://abdinusababellibrary.ac.id/repository/hacker-minecraft-song_GM479516143.pdf
    • http://abdinusababellibrary.ac.id//repository/how-to-hack-roblox-passwords_GM431946152.pdf
    • http://abdinusababellibrary.ac.id//repository/is-it-possible-to-get-free-tiktok-followers_GM835599320.pdf
    • http://abdinusababellibrary.ac.id//repository/roblox-com-hack_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000054af.bin
2548e98d64be7278d2cd7801513e6e627f2b0ac228072510e0f6a8dd46fda1cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54AF 24596 bytes
font_01_sfnt_off00008cb5.bin
b053084cafd01c649462d87667ba56c569d6480ce60e7d20ae57ef6124cf178e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CB5 2880 bytes
font_02_sfnt_off000096a0.bin
107932d4c819bf12e68df3d86f91d46cdcad91a8442b853cf72bc94cc41b7ea1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96A0 17748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.