Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c92d30ba592b182…

MALICIOUS

PDF

46.9 KB Created: 2021-05-20 19:05:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 5f781998b8de9ceaecac5248e88e1626 SHA-1: 524f7d6b19052e2bc6ef5eb64d390d6450ec2da5 SHA-256: 5c92d30ba592b18299d425fdf29240f9fa6fac928024a9fc8b1763a82b6c1c53
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple embedded URLs and heuristics indicating a lure for downloading content. The presence of a 'download button' lure and a QR code suggests an attempt to trick the user into visiting malicious sites or downloading further payloads. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7663

Heuristics 4

  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/free-vpn-for-minecraft-game-hack
    • http://grupodin.com.br/images/what-is-coin-master-app_GM406889139.pdf
    • http://grupodin.com.br/images/how-to-get-more-spins-on-coin-master-hack_GM406889139.pdf
    • http://grupodin.com.br/images/coin-master-tiradas-gratis-link_GM406889139.pdf
    • http://grupodin.com.br/images/roblox-got-talent-piano-hack_GM431946152.pdf
    • http://grupodin.com.br/images/roblox-fun-com-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000359c.bin
84ba27c2c2fa8500963ea79b1a528f4eb4a2b6fda58c92c8bdb74d7fc694745c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x359C 26304 bytes
font_01_sfnt_off00006f38.bin
218d53b68bdddb064f6fba4be822d5b3725ed1cef1a3b42796a8dd99c4a62f4e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F38 7936 bytes
font_02_sfnt_off00008862.bin
ab6320ab342704d2c5943abfba82ed4837bf2da871c91621741fd4cfd15c6ed5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8862 4232 bytes
font_03_sfnt_off000096ef.bin
911504367fe567166c33f6e3692a77db00fa7c0328364f4a395a35c32f792d6f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96EF 18020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.