Malicious PDF — malware analysis report

Static analysis result for SHA-256 6782e012a8394e6d…

MALICIOUS

PDF

41.9 KB Created: 2021-05-17 02:04:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 94a973382bdecfa06653bb9b821a108d SHA-1: 82173a0855b3ab23e13268029fc6deb3f556b386 SHA-256: 6782e012a8394e6d54c95264e23de69c0f4a85d2b61ef7d7a4f93a84c07cc4aa
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a document body that promotes free in-game currency for games like Minecraft and Roblox. The ML classifier strongly flagged this PDF as malicious. The presence of numerous links to external sites, many of which are themed around game cheats and hacks, suggests a lure to download malware or visit a phishing page.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-free-minecoins-game-hack
    • http://bestmaids.co.uk/images/roblox-hack-game_GM431946152.pdf
    • http://bestmaids.co.uk/images/how-to-get-free-robux-on-roblox-2021_GM431946152.pdf
    • http://bestmaids.co.uk/images/cm-spin-link_GM406889139.pdf
    • http://bestmaids.co.uk/images/cheats-coin-master-free_GM406889139.pdf
    • http://bestmaids.co.uk/images/how-to-get-free-robux-promo-codes_GM431946152.pdf
    • http://bestmaids.co.uk/images/best-free-minecraft-hacked-client_GM479516143.pdf
    • http://bestmaids.co.uk/images/spin-coin_GM406889139.pdf
    • http://bestmaids.co.uk/images/my-roblox-account-was-hacked_GM431946152.pdf
    • http://bestmaids.co.uk/images/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdf
    • http://bestmaids.co.uk/images/coin-master-free-cards-link-2021_GM406889139.pdf
    • http://bestmaids.co.uk/images/real-coin-master-free-spins_GM406889139.pdf
    • http://bestmaids.co.uk/images/free-robux-real-working_GM431946152.pdf
    • http://bestmaids.co.uk/images/500-free-coin-master-spins_GM406889139.pdf
    • http://bestmaids.co.uk/images/coin-master-spin-link-free-download_GM406889139.pdf
    • http://bestmaids.co.uk/images/coin-master-hack-mod-apk_GM406889139.pdf
    • http://bestmaids.co.uk/images/free-robux-app_GM431946152.pdf
    • http://bestmaids.co.uk/images/minecraft-windows-free_GM479516143.pdf
    • http://bestmaids.co.uk/images/roblox-hacks-for-mac_GM431946152.pdf
    • http://bestmaids.co.uk/images/how-to-hack-roblox-accounts-for-robux_GM431946152.pdf
    • http://bestmaids.co.uk/images/free-roblox-card_GM431946152.pdf
    • https://sigmaclient.info#2
    • https://flux.today#3
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000048a7.bin
ace40c35abb9951a6c24700944a3760de6049891e82bfc6a7c901d865654a2a4		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x48A7 25940 bytes
font_01_sfnt_off00008351.bin
84922fa40070066ef4f1a201e85f9de45244526ee00faa1dc92053ed0f889265		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8351 17712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.