Malicious PDF — malware analysis report

Static analysis result for SHA-256 5688f19839fce258…

MALICIOUS

PDF

46.0 KB Created: 2021-05-12 10:09:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 81467f69e9b3e53455d9ea978ef26760 SHA-1: 2d9faa7e8e3bc150f616ba858474b765529d212a SHA-256: 5688f19839fce258760511c5555ad4e28fdbaeed5521880716d8b8c4cdfc8e43
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains embedded URLs that lead to suspicious download pages, masquerading as game cheats or hacks. The ML classifier and the malicious redirector heuristic strongly indicate malicious intent. The document body and extracted URLs suggest a lure to download potentially unwanted or malicious applications.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9432

Heuristics 4

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-1.16-apk-download-game-hack In PDF document text
    • http://prodajalec.si/images/free-robux-without-human-verification-real_GM431946152.pdfIn PDF document text
    • http://prodajalec.si/images/coin-master-offline-hack_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/free-robux-mobile_GM431946152.pdfIn PDF document text
    • http://prodajalec.si/images/coin-master-free-spins-2021_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/roblox-free-robux-no-verification_GM431946152.pdfIn PDF document text
    • http://prodajalec.si/images/free-roblox-app_GM431946152.pdfIn PDF document text
    • http://prodajalec.si/images/tower-of-hell-roblox-hack_GM431946152.pdfIn PDF document text
    • http://prodajalec.si/images/coin-drop-master-free_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/coin-master-hack-apk-35-11_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/free-coin-master-spins-link_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/how-to-get-free-robux-on-iphone_GM431946152.pdfIn PDF document text
    • http://prodajalec.si/images/free-spins-and-coins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/minecraft-texture-packs-free-download_GM479516143.pdfIn PDF document text
    • http://prodajalec.si/images/hack-coin-master-for-iphone_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/free-coins-on-coin-master-generator_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/how-to-get-java-minecraft-free_GM479516143.pdfIn PDF document text
    • http://prodajalec.si/images/coin-master-code-hack_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/free-robux-generator-com-roblox-hack_GM431946152.pdfIn PDF document text
    • http://prodajalec.si/images/free-coin-master-spins-and-coins_GM406889139.pdfIn PDF document text
    • http://prodajalec.si/images/how-to-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004b64.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B64 25708 bytes
SHA-256: c0af5c32c4503d9f48a5bbd7263970b6f6fc14e948287f08f74f6c471f3fa070
font_01_sfnt_off000085cd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x85CD 2820 bytes
SHA-256: 972979c3a46100cf5f8fd289bc6fbd2496ff75fec0e3f6753648c72ec6eba714
font_02_sfnt_off00008f6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8F6D 18976 bytes
SHA-256: 66d37f1f8a6aa07be6e2b5788d3f6b7c3f727c7395e5f0cbde4181c4dd6d3b3c

Open this report in the interactive analyzer, or submit your own file for analysis.