Malicious PDF — malware analysis report

Static analysis result for SHA-256 36fe2ea7f92b8000…

MALICIOUS

PDF

47.7 KB Created: 2021-05-10 17:02:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-13
MD5: ceaae8d14941204c1c8f6db714500ce5 SHA-1: 6b860eb2e287d32e615230d4a58170739bf9df5e SHA-256: 36fe2ea7f92b8000465087e9c6e49d4479ad45b0ce077e0a0b764298eacc4c4a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains embedded links to known malicious redirector infrastructure, specifically promoting fake game hacks and currency offers. The document body and extracted URLs reinforce this lure, aiming to trick users into downloading malware or visiting phishing sites. The presence of a malicious redirector link is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9013

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-1.16-free-game-hack In PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/tryrbx-site-free-robux_GM431946152.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/tryrbx-site-free-robux_GM431946152.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/roblox-18_GM431946152.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/free-roblox-avatar_GM431946152.pdfIn PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/how-to-get-free-robux-no-survey_GM431946152.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/minecraft-free-version_GM479516143.pdfIn PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/how-do-you-get-free-coins-in-coin-master_GM406889139.pdfIn PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/coin-master-free-spins-for-today_GM406889139.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/how-to-get-free-robux-without-verification_GM431946152.pdfIn PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/tower-of-hell-roblox-hack_GM431946152.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/free-coin-master-spins-blog_GM406889139.pdfIn PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/cheats-for-coin-master_GM406889139.pdfIn PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/free-spins-coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/minecraft-client-download_GM479516143.pdfIn PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/coin-master-hack-apk-35-8_GM406889139.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/how-to-get-free-robux-on-android_GM431946152.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/coin-master-daily-gift-free-spins-and-coins_GM406889139.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/fighting-free-card-coin-master_GM406889139.pdfIn PDF document text
    • https://www.beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/free-coins-coin-master-iphone_GM406889139.pdfIn PDF document text
    • https://beestonprimaryschool.co.uk/admin/ckfinder/userfiles/files/roblox-phantom-forces-hack_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000050dd.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x50DD 29868 bytes
SHA-256: 748641669369f41391cf37f3f0cfc81551081fd8a0e558c85830476b111df0da
font_01_sfnt_off00008fb0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8FB0 2840 bytes
SHA-256: 3fb127b764b9d10f5525bc4de5ec8316de704409ccb0cf21cff3ad8a30d11676
font_02_sfnt_off00009962.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9962 17908 bytes
SHA-256: 8310a8a70ae495dc6c5eef129ed79833fdc59e5dcfd7da15d006a4c6032bb3ed

Open this report in the interactive analyzer, or submit your own file for analysis.