Malicious PDF — malware analysis report

Static analysis result for SHA-256 46fa8d8fe53fb2ac…

MALICIOUS

PDF

49.3 KB Created: 2021-05-30 12:35:18 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 72ef17f94121d7e81436b9c6a77ac52d SHA-1: 550c937080e20ccedf5249f9d8791ed142252aae SHA-256: 46fa8d8fe53fb2ac1f9e05c6416d1f889664ea2abcc3f96497b624ef9d780c32
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs pointing to sites offering free in-game items, a common lure for phishing or malware distribution. The ML classifier also flagged the document as malicious. While no scripts were directly extracted, the presence of external URIs and the document's content suggest it's designed to redirect users to potentially harmful websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8017

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/835599320/free-tiktok-followers-without-verification-game-hack
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/how-to-get-minecraft-realms-for-free_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/get-free-robux_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/tiktok-followers-for-free_GM835599320.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-online-minecraft-server_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-coin-master-coins-and-spins_GM406889139.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-robux-generator-for-kids_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/minecraft-free-ios_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-robux-survey_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-coin-master-spins-2021_GM406889139.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-robux-kid-friendly-no-human-verification_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/how-do-you-get-free-robux-on-roblox_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-modded-minecraft-server-hosting_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-spins-and-coins-for-coin-master_GM406889139.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-tiktok-followers-no-survey_GM835599320.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/how-to-get-hacks-on-minecraft_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/coin-master-free-spin-and-coins-links-2021_GM406889139.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/how-do-you-get-free-robux_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/minecraft-download-free-download_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-college-textbooks-tiktok_GM835599320.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-minecraft-skins_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/minecraft-pe-free-download-ios-no-jailbreak_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/earn-free-robux_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/tiktok-views-free_GM835599320.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/how-to-install-minecraft-for-free_GM479516143.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/how-do-u-get-free-robux_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/free-robux-without-human-verification-2021_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/roblox-free-robux-codes_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/bux-life-free-robux_GM431946152.pdf
    • https://brsolutions.pl/wp-content/uploads/fsqm-files/was-minecraft-ever-free_GM479516143.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000052b0.bin
970ec9e5abe6ffd11b9453f3356d8e61f8ecde4698781af0e1cc93d93eedc729
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x52B0 26148 bytes
font_01_sfnt_off00008e9b.bin
e3208f3d9e21ac0d7ce2080a5beeef8ecd44cdb4c86e402d1f0fd860a81a6d6d
pdf-font-stream PDF embedded font (sfnt) at offset 0x8E9B 4284 bytes
font_02_sfnt_off00009ceb.bin
4328f2d9021fda272d6942102c30ad90396447c40598e55ae21b07e1aa723a10
pdf-font-stream PDF embedded font (sfnt) at offset 0x9CEB 18560 bytes