Malicious PDF — malware analysis report

Static analysis result for SHA-256 44d05b83844879ee…

MALICIOUS

PDF

36.8 KB Created: 2021-05-13 02:31:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: d73967a8e27142e988335e5d2223a6da SHA-1: 69f59b61ba67cb46a41053ac53325b68aec12577 SHA-256: 44d05b83844879ee99cff76eeb59ecbc5ec8a00cc1e1010a8ba8f85971a9a686
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a heuristic firing for a malicious redirector link pointing to a website offering 'Coin-master tips and cheats'. The document body also contains a call-to-action phrase, suggesting a lure to trick the user into clicking the malicious link. The embedded URL is likely intended to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier clean score 0.0292

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/freegames911.com-coin-master-tips-and-cheats-2021-free-coins-and-spins-game-hack In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00003358.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3358 24416 bytes
SHA-256: 5b003910c75303d617356263b4478d101dbfb48b477e037625aeb9e1be399b8e
font_01_sfnt_off00006b03.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B03 19440 bytes
SHA-256: d21e09e6d84846a171b344f261e29994bfe04b5ec0080f7ce55354125b7c97ed

Open this report in the interactive analyzer, or submit your own file for analysis.