Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b9ae10acc72d2c8…

MALICIOUS

PDF

35.0 KB Created: 2021-07-09 04:55:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: b43f8445d7b4cdf793d8e090c2d41304 SHA-1: 42ef793c01412ac56755bdd8ce182d7e2ce9e3bf SHA-256: 4b9ae10acc72d2c8a1625c379b27166c3914c76f5d75f0253d2aab4a89ee3a59
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF document contains a prominent link to a "free generator / game hack" website, a common lure for users seeking cheats or in-game currency. This heuristic, combined with the ML classifier's high confidence, indicates a malicious intent to redirect users to potentially harmful content. The document body and extracted URLs reinforce this by mentioning game hacks and free generators, suggesting the primary goal is to trick users into visiting these sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-free-gifts-game-hack PDF link annotation
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/free-robux-site_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/mcpe-hacks_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/how-do-you-hack-for-2021000-coins-on-flip-master_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/roblox-hack-download_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/free-cheat-codes-for-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/do-you-get-minecraft-windows-10-for-free_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/universal-minecraft-converter-free_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/roblox-jailbreak-money-hack-script_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/free-robux-eu5-net_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/oprewards-login_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/minecraft-windows-10-hacks_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/free-spins-coin-master-2021-no-verification_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/coin-master-spin-hack-no-verification_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/coin-master-free-coins-and-spins-daily_GM406889139.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/tiktok-followers-for-free_GM835599320.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/how-to-make-a-minecraft-pe-server-for-free_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-without-human-verification_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/free-private-server-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/how-to-get-free-minecoins-in-minecraft_GM479516143.pdfIn PDF document text
    • https://elearning.mtsn1pringsewu.sch.id/__statics/gudangsoal/files/roblox-speed-hack_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033bb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33BB 22896 bytes
SHA-256: e1da6e5cbd05494cb8d126546d9e7f7f139e872473689a125254bd800d0f2998
font_01_sfnt_off00006722.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6722 17996 bytes
SHA-256: 0554876b2ab95b57b2a8903cbabfbfa90e4f9f04422ab63317bc25d957b52972

Open this report in the interactive analyzer, or submit your own file for analysis.