Malicious PDF — malware analysis report

Static analysis result for SHA-256 63cb7cc267579c6f…

MALICIOUS

PDF

42.0 KB Created: 2021-05-17 20:42:20 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 8875fd86b3ab18de7180e9e0c0580c73 SHA-1: 1da1f2bcaa32230b1635e2da57547f5473180621 SHA-256: 63cb7cc267579c6f71c270a6ca00f509dfd9ec88956ab83f690ed9a288c31716
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains multiple embedded URLs and a call-to-action lure, suggesting it is designed to trick users into downloading malicious content, such as a "hacked client". The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs indicates a likely download attempt. No scripts were extracted, but the document's structure and content point towards a malicious download lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-windows-10-hacked-client-game-hack
    • http://www.thecoffeebaron.co.za/images/roblox-gang-rape_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/free-robux-com-roblox_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/withdraw-robux_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/how-to-get-free-robux-app_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/coin-master-daily-free-spins-link-march-2021_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/coin-master-free-spins-ios-app_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/free-robux-ad_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/is-it-possible-to-get-free-robux_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/robux-scam_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/free-robux-without-survey_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/getrobux-info_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/coin-master-hack-tool-apk-download_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/cm-daily-spins_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/coin-master-hack-mod-apk-free-download_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/robuxlove-net-free-robux_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/minecraft-pocket-edition-free-ios_GM479516143.pdf
    • http://www.thecoffeebaron.co.za/images/coin-master-tricks_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/free-robux-obby-2021_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/free-spins-and-coins-coin-master-app_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/free-roblox-intros_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004992.bin
18f806787f8f66f9c8ff95d16c15814e71e8e3123741b786e45771c61388b654		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4992 24068 bytes
font_01_sfnt_off0000802d.bin
f9a71ab68452ae4ccd094805e59123059ba28481ac44c73a337d9a6d18fc1d00		 pdf-font-stream PDF embedded font (sfnt) at offset 0x802D 18768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.