Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d14bb58425a469f…

MALICIOUS

PDF

35.4 KB Created: 2021-07-06 14:37:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: d0f577d308208955621e72cea7df6820 SHA-1: 4a761e4aa5f8bfc3eb0a46e61126a345d734cfa1 SHA-256: 3d14bb58425a469fc91d60120562b23c7363f9d1268ccd9c8576f69cbe2f07b3
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a clear call-to-action and an embedded URL pointing to a game hack download. The ML classifier strongly flagged this PDF as malicious, and the presence of a download button lure and password archive lure heuristics further support a malicious intent. The primary IOC is the URL used to distribute the payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-hack-apk-free-download-game-hack
    • http://elibrary.smknesbu.sch.id/repository/how-to-wear-no-clothing-in-roblox-for-free_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/how-to-get-robux-for-free-2021_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/a-game-that-someone-cant-hack-in-roblox_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/robux-hack-no-verifaction-or-passord_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/roblox-hack-account-script_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/como-volar-en-roblox-hack-2021_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/how-to-make-a-minecraft-pe-server-for-free_GM479516143.pdf
    • http://elibrary.smknesbu.sch.id/repository/roblox-life-free-robux_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/youtube-live-free-robux_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/how-to-get-free-robux-hack_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/get-free-robux-no-scam-no-builders-club_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/free-redeemable-robux-codes_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/cheat-pour-phantom-force-roblox_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/free-spin-and-coin-blogspot-com_GM406889139.pdf
    • http://elibrary.smknesbu.sch.id/repository/can-you-get-roblox-on-switch-for-free_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/cheat-roblox-2021-la-dernier-misajoure_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/hack-cheats-for-roblox_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/buzz-the-bee-robux-hack_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/how-to-hack-roblox-passwords_GM431946152.pdf
    • http://elibrary.smknesbu.sch.id/repository/roblox-bubblegum-simulator-cheats-2021_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000321f.bin
1a1a96156f7aa6b561676313713c02156b2041c6cd18c467254c81e9f3514805		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x321F 22972 bytes
font_01_sfnt_off000065e5.bin
38aff1f4ebc8d6a2cfc831d742e7ae34be9a6d1c0d894ae7a66b024f0bdab889		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65E5 18924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.