Malicious PDF — malware analysis report

Static analysis result for SHA-256 3872647b46bc47a2…

MALICIOUS

PDF

42.6 KB Created: 2021-06-03 05:09:42 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 59c47bebbeaeebac14208db6a7dd2626 SHA-1: 6a3270e47f448924721ba260641c6a490389fc23 SHA-256: 3872647b46bc47a223c39a511027645fa7f742fd3910fe9545579cbf4d90f7c3
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The document employs a social engineering tactic by presenting itself as a lure for a browser extension or update, encouraging the user to download a file. The presence of external URIs and the ML classifier's high confidence score indicate malicious intent. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it is designed to facilitate the download of a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9874

Heuristics 4

  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/835599320/likes-for-tiktok-free-game-hack
    • http://pustaka.stikesperintis.ac.id/repository/google-roblox-games_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/free-robux-no-offers_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-free-spins-hack-link_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/mcpe-master-hack-coin-apk_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/free-coins-coin-master-2021_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-free-soins_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-free-card-link-today_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/pig-master-free-coins-and-spins_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-blogspot-free-spins_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/how-to-make-free-robux_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/how-to-download-minecraft-for-free-on-android_GM479516143.pdf
    • http://pustaka.stikesperintis.ac.id/repository/free-coin-master-coins-and-spins_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/rbl-gg-free-robux_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/free-executors-for-roblox_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/hack-client_GM479516143.pdf
    • http://pustaka.stikesperintis.ac.id/repository/hack-coin-master-1_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/free-robux-without-verify_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-hack-apk-download-for-android_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-hack-game-download_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/roblox-speed-hack_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005094.bin
85f733b4ca71f644ae97b02598ce60a3ca5c8b0df9747be1d86cff20df393689		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5094 23628 bytes
font_01_sfnt_off00008654.bin
94a5449a653c8b993d4195c76b5d33b1ca50c3b72d0bd7f8ceb1c420b30f043c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8654 17456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.