Malicious PDF — malware analysis report

Static analysis result for SHA-256 46cf695b85111be9…

MALICIOUS

PDF

43.8 KB Created: 2021-06-03 20:52:51 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: ea3ccd8d4e0733b5ebb212d67f147450 SHA-1: a512fb0749b9cd6ba1b826ef81dd6580e7494b6c SHA-256: 46cf695b85111be946d7f856c0d8608d8d2ecb70f104be33f89ce81b9193d8e8
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The document contains numerous URLs pointing to sites offering game hacks and free downloads, strongly suggesting a lure for users seeking such content. The presence of a 'remote-support tool lure' heuristic, combined with the overall theme, indicates a potential attempt to trick users into downloading and installing malware under the guise of game cheats or tools. No scripts were extracted, but the embedded URLs are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 4

  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/479516143/minecraft-apk-free-download-game-hack PDF link annotation
    • https://kojak-group.com/userfiles/files/roblox-rape-hack_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/how-to-get-minecraft-for-free-on-computer_GM479516143.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/make-free-robux_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/coin-master-spin-hack_GM406889139.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/hack-to-protect-village-on-coin-master_GM406889139.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/coin-master-free-spins-link-blogspot-today_GM406889139.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/how-do-you-get-free-food-on-coin-master_GM406889139.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/rbl-gg-free-robux_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/free-daily-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/minecraft-name-tag-hacks_GM479516143.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/minecraft-client-download_GM479516143.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/free-robux-games-on-roblox_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/free-roblox-exploits_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/how-to-get-free-skins-in-roblox_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/free-robux-hack_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/free-spin-hack-coin-master-2021_GM406889139.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/roblox-jailbreak-hack-download_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/coin-master-online_GM406889139.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/free-robux-generator-2021-no-human-verification-or-survey_GM431946152.pdfIn PDF document text
    • https://kojak-group.com/userfiles/files/coin-master-tricks_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00004fa4.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4FA4 24960 bytes
SHA-256: 7666ec4a8fb105638c1ec4165981878b3ac84fd2d00344f169f146724341fda7
font_01_sfnt_off000087ab.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x87AB 18636 bytes
SHA-256: 460052af6c2621f53863fdd0e184641c8149664fef9b3bc68df6f3fcb4cff320

Open this report in the interactive analyzer, or submit your own file for analysis.