Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ea4105972d7f215…

MALICIOUS

PDF

34.9 KB Created: 2021-07-03 15:48:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 40720f0d81051373a367e54d4aa21566 SHA-1: a976328e815ae34de6730cbc6108d9f51ee4b5ff SHA-256: 4ea4105972d7f215bbe74741c42aaf796e46848765b90a297ee425a51a110e67
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document employs a social engineering tactic, luring the user with promises of game hacks and free items to encourage the installation of a browser extension or viewer. The embedded URL and numerous linked documents suggest a phishing or malware distribution campaign. While no scripts were explicitly extracted, the PDF structure and embedded links are indicative of malicious intent, likely to lead to credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 5

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/how-to-hack-roblox-2021-game-hack PDF link annotation
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/hack-xp-mad-city-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/how-to-get-minecraft-for-free-on-computer_GM479516143.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-roblox-card_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-roblox-clothes-girl_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-robux-only-1-step_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/get-2021-free-robux-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/how-to-use-wurst_GM479516143.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-robux-obby-2021_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/coin-master-free-spins-today-daily-links_GM406889139.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-free-robux_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/2021-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/coin-master-free-spins-8-14-2021_GM406889139.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/coin-master-hack-2021-ios_GM406889139.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-roblox-paddwords-cracker-chrome-extension_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/how-to-get-free-chest-in-coin-master_GM406889139.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-roblox-hack_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/100-free-coin-master-spins_GM406889139.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-robux-please_GM431946152.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/coin-master-free-spins-link-today_GM406889139.pdfIn PDF document text
    • https://elearning.masirsyad.sch.id/__statics/gudangsoal/files/free-spins-coin-master-blogspot_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f9e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F9E 22764 bytes
SHA-256: d19f8c3d0b000f63185bb9427c392586b6fd29f26f4967451a0518e62faecfdf
font_01_sfnt_off0000627c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x627C 19224 bytes
SHA-256: 952aa56c448a3876108b271681fe1a59f9d49131b8b4cd095e69c290d9073af5

Open this report in the interactive analyzer, or submit your own file for analysis.