Malicious PDF — malware analysis report

Static analysis result for SHA-256 4940feaccfd950fd…

MALICIOUS

PDF

45.6 KB Created: 2021-05-10 17:34:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 00e6bbcd0d81ab9be3a1627c97beecab SHA-1: 656afae96e51cafb98d2b4011649df876bfca3f1 SHA-256: 4940feaccfd950fdd17923a1f31b589b4c60431adbbcfc55d99a3181bac2eae9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a primary external URI pointing to game-related downloads, suggesting a lure for users seeking free game content. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded links indicates an attempt to redirect users to potentially harmful sites. While no scripts were explicitly extracted, the PDF structure and embedded links are consistent with a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9507

Heuristics 4

  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-maps-pe-free-download-game-hack PDF link annotation
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/roblox-adopt-me-free-pets_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/minecraft-client-download_GM479516143.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/free-robux-2021-no-human-verification_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/free-minecraft-severs_GM479516143.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/weird-roblox_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/free-robux-reddit_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/rbx-gg-free-robux_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/coin-master-free-spins-link-haktuts_GM406889139.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/mcpe-master-unlimited-coins-free-download_GM406889139.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/apps-for-free-robux_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/roblox-cp_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/roblox-free-robux-no-verification_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/free-coin-master-link-2021_GM406889139.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/how-to-get-100-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/coin-master-free-spins-5-10-2021_GM406889139.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/free-robux-without-human-verification-2021_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/coin-master-daily-gift-free-spins-and-coins-link_GM406889139.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/haktuts-coin-master-free-spin-link_GM406889139.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/how-can-you-get-free-robux_GM431946152.pdfIn PDF document text
    • https://www.elearning.ma-alkhairiyah.sch.id/__statics/gudangsoal/files/minecraft-hacked-client-112-2_GM479516143.pdfIn PDF document text
    • https://freegiftcodes.euIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004d65.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4D65 24488 bytes
SHA-256: 1df3eac8aee9459f6584974035efb65847388da027920a53bb636d944bcbb658
font_01_sfnt_off000084bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84BC 2884 bytes
SHA-256: de996c9b28101dfe2eac14b3ac925cc027dc97355fea1fe60e83912384ec3508
font_02_sfnt_off00008eb1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8EB1 18620 bytes
SHA-256: 0821b230906a16eab24876bc900cf5b44140eb476c0c2d68670d368f294fcdb9

Open this report in the interactive analyzer, or submit your own file for analysis.