Malicious PDF — malware analysis report

Static analysis result for SHA-256 3420963f7ec2991a…

MALICIOUS

PDF

42.6 KB Created: 2021-05-11 21:10:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 7fe128168e28b379c41b550b23365860 SHA-1: aabb4c54ba569fc90b4e91bbc700f89cef7f0c07 SHA-256: 3420963f7ec2991a13f93ff08e87087cb3c0d4cdec2964086da2a348d6930821
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs and a call-to-action phrase, suggesting a lure for users to download additional content. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs indicates an attempt to redirect the user to potentially harmful resources. The document body, though partially corrupted, contains references to free in-game items, a common social engineering tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-shirt-roblox-game-hack
    • http://202.182.59.89/perpus/repository/free-downloads-for-coin-master-daily-rewards_GM406889139.pdf
    • http://202.182.59.89/perpus//repository/how-to-get-800-robux-for-free_GM431946152.pdf
    • http://202.182.59.89/perpus/repository/how-to-make-your-own-minecraft-pe-server-for-free_GM479516143.pdf
    • http://202.182.59.89/perpus/repository/how-to-make-a-server-in-minecraft-java-for-free_GM479516143.pdf
    • http://202.182.59.89/perpus/repository/coin-master-level-4_GM406889139.pdf
    • http://202.182.59.89/perpus/repository/coin-master-daily-bonus_GM406889139.pdf
    • http://202.182.59.89/perpus//repository/coin-master-free-stuff_GM406889139.pdf
    • http://202.182.59.89/perpus/repository/how-to-get-free-cards-for-coin-master_GM406889139.pdf
    • http://202.182.59.89/perpus//repository/get-free-robux_GM431946152.pdf
    • http://202.182.59.89/perpus/repository/free-robux-no-human-verification-or-survey-2021_GM431946152.pdf
    • http://202.182.59.89/perpus/repository/rbxoffer-com-free-robux_GM431946152.pdf
    • http://202.182.59.89/perpus/repository/coin-master-hack-tuts_GM406889139.pdf
    • http://202.182.59.89/perpus/repository/2021-free-spins-coin-master_GM406889139.pdf
    • http://202.182.59.89/perpus/repository/roblox-comroblox_GM431946152.pdf
    • http://202.182.59.89/perpus/repository/is-there-a-way-to-get-free-robux_GM431946152.pdf
    • http://202.182.59.89/perpus/repository/coin-master-400-spin-link-today_GM406889139.pdf
    • http://202.182.59.89/perpus//repository/hack-master-coin_GM406889139.pdf
    • http://202.182.59.89/perpus//repository/free-minecraft-skins-girl_GM479516143.pdf
    • http://202.182.59.89/perpus//repository/how-to-get-free-things-on-roblox_GM431946152.pdf
    • http://202.182.59.89/perpus/repository/where-can-i-get-free-spins-for-coin-master_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004951.bin
ba7d57566985f60e698dfb521435bf92ea6e58cf1e413825332ff0376010fa2b		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4951 26804 bytes
font_01_sfnt_off00008442.bin
3ca5c604ac15960a7f8a0c65ef4d0081823d5f41fce5965982f8abd8b2da9d57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8442 18340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.