Malicious PDF — malware analysis report

Static analysis result for SHA-256 545e0805278cdc3e…

MALICIOUS

PDF

42.4 KB Created: 2021-05-19 07:12:15 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 0c8936722e6e89b0b8d0f1f088396d8d SHA-1: 8b2e6840fd0df4eb3ba3da1ad5ed6349583e2e37 SHA-256: 545e0805278cdc3e611640bd261b3b4de7598e4309465394989ea0238efde20f
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains a lure related to 'Pokemon Go Free In App Purchases' and includes multiple embedded URLs pointing to sites offering hacks and free spins for various games. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs suggests an attempt to redirect the user to a malicious download or phishing page. Although no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/1094591345/pokemon-go-free-in-app-purchases-game-hack
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-link-deutsch-ios_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-hack-blog_GM406889139.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/roblox-hack-generator_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-tiradas-gratis_GM406889139.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/how-to-hack-roblox-accounts-on-phone-2021_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/hack-version-of-coin-master-apk-download_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/free-spin-gratis-coin-master_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-claim-free-spins_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/roblox-no-download-hack_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/roblox-apk-hack_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-daily_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/get-free-robux-now_GM431946152.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/robux-codes-generator-no-human-verification_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/games-to-get-free-robux_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-hack-apk-download-2021_GM406889139.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-hack-download_GM406889139.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/free-card-link-coin-master_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/minecraft-jar-free_GM479516143.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/minecraft-pe-apk_GM479516143.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-hack-without-verify_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004a43.bin
59cea44b44931e1b66c95d10a591d9fa9b6eb1d10824a0551971d8ba5e579439		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4A43 24764 bytes
font_01_sfnt_off00008309.bin
c18418075ae4e70ff9a8ab0067a109abf0422c91553959beee23b19cede12f1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8309 18552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.