Malicious PDF — malware analysis report

Static analysis result for SHA-256 479782b1d00eedd6…

MALICIOUS

PDF

45.3 KB Created: 2021-06-03 23:18:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 1a356ff1852b024759276a0effd83bc4 SHA-1: 5fc8fcf2a99753ff73ff904096b03dd37726ecef SHA-256: 479782b1d00eedd6c43d503e3bc2407538a3f36fa7e9679b19d8349f41cb2ab8
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs, including one pointing to an IP address, that are likely intended to lead the user to download malicious content. The document's title and the nature of the URLs suggest a lure related to game cheats or in-game currency. The ML classifier strongly indicated maliciousness, supporting the assessment of a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/hacks-for-da-hood-roblox-game-hack PDF link annotation
    • http://103.68.2.77/__statics/gudangsoal/files/free-minecraft-bedrock-server-hosting_GM479516143.pdfPDF link annotation
    • http://103.68.2.77/__statics/gudangsoal/files/free-coin-master-coins_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-free-robux-fast-and-easy_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-spins-coins-coin-master_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/roblox-sign-in-free_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/minecraft-iphone-free_GM479516143.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-2021-robux_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-robux-that-actually-works-2021_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-vip-roblox_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/robux-hack-2021_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-tiktok-likes-2021_GM835599320.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-minecraft-for-free-on-xbox-360_GM479516143.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/moonactive-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-robux-wheel_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/minecraft-mac-free_GM479516143.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/huskybuckscom-free-robux_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/300-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-robux-working_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-robux-no-human-verification-no-survey_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005219.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5219 25428 bytes
SHA-256: a9138a72f8698c557eb66b41ef1f7d9ddacadf4d12ee4d6065ba6fdf7b991903
font_01_sfnt_off00008d50.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D50 18688 bytes
SHA-256: 2371aab8d43151a46355cfc7671a78e919a4b2b06070559b712049e090cd0272

Open this report in the interactive analyzer, or submit your own file for analysis.