Malicious PDF — malware analysis report

Static analysis result for SHA-256 67abbcb58383bc66…

MALICIOUS

PDF

45.5 KB Created: 2021-05-20 02:44:51 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 32dfaa3f29a7a51ae78b09f4d273cea9 SHA-1: 8937f2f8a3b6453cfabb0137c040aadd9df5c104 SHA-256: 67abbcb58383bc66941c8217a274fae344cbb57e03ada5d544a243a7a324d92b
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a heuristic firing for an MFA lure, suggesting a phishing attempt. The document body, though garbled, contains references to 'tiktok-free-wala-video-game-hack' and a URL pointing to a similar resource, indicating a lure for free game hacks or similar content. The presence of MFA lure heuristics suggests an attempt to harvest credentials or session tokens. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9507

Heuristics 4

  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/835599320/tiktok-free-wala-video-game-hack PDF link annotation
    • http://cmme.it/images/where-to-get-robux_GM431946152.pdfIn PDF document text
    • http://cmme.it/images/free-tiktok-followers-quora_GM835599320.pdfIn PDF document text
    • http://cmme.it/images/coin-master-heaven-free-spins-link-2021-today_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/free-robux-groups-2021_GM431946152.pdfIn PDF document text
    • http://cmme.it/images/coin-master-hack-version-download-2021_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/coin-master-hack-mod-apk-unlimited-spins_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/minecraft-account-hacked_GM479516143.pdfIn PDF document text
    • http://cmme.it/images/roblox-robux-codes-2021_GM431946152.pdfIn PDF document text
    • http://cmme.it/images/roblox-imagine_GM431946152.pdfIn PDF document text
    • http://cmme.it/images/coin-master-free-spins-link-blogspot_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/how-do-i-get-free-coins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/coin-master-daily-free-spins-2021_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/free-spin-coin-master-game_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/free-robux-no-anti-bot-verification_GM431946152.pdfIn PDF document text
    • http://cmme.it/images/coin-master-generator-hack_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/coin-master-free-spins-16-04-19_GM406889139.pdfIn PDF document text
    • http://cmme.it/images/free-minecraft-shaders_GM479516143.pdfIn PDF document text
    • http://cmme.it/images/robuxy-com-generator_GM431946152.pdfIn PDF document text
    • http://cmme.it/images/roblox-promo-codes-for-free-robux_GM431946152.pdfIn PDF document text
    • http://cmme.it/images/free-robux-no-verification-2021-android_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000464c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x464C 27340 bytes
SHA-256: 9b33ea9a3e1b81b3a2d97711a470ddb5ba80905cf27f10a59d512bd8431e1b9d
font_01_sfnt_off0000846e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x846E 3124 bytes
SHA-256: d6dd29adb69da7f9a23a5e3791282a61e2f811794f560a0c409c8747766d9102
font_02_sfnt_off00008f28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8F28 18264 bytes
SHA-256: 378f146fbafe3af1974af13c077e7c5b95ac8bb1f8578d3e3feaa96e0d66cf20

Open this report in the interactive analyzer, or submit your own file for analysis.