Malicious PDF — malware analysis report

Static analysis result for SHA-256 6d89b385e7ea2d91…

MALICIOUS

PDF

42.4 KB Created: 2021-05-14 13:44:43 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 80464d3c80a57529166307d0612f50cf SHA-1: 6a5736f4b9ddd8ad9e979829f2bce5a1953417b4 SHA-256: 6d89b385e7ea2d91cd7c025178bde7f0c44ebe2a3562e4bcc5a4db5c2cb6b6f3
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains embedded URLs and heuristics indicating a lure for downloading potentially malicious content, such as game hacks. The presence of a payment redirection lure suggests an attempt to deceive users financially or gain access to sensitive information. The ML classifier strongly flags this PDF as malicious, supporting the conclusion that it is designed to trick users into downloading and executing further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/login-robux-game-hack
    • http://beagle-cindy.de/images/roblox-robux-hack_GM431946152.pdf
    • http://beagle-cindy.de/images/how-to-get-free-robux-without-human-verification_GM431946152.pdf
    • http://beagle-cindy.de/images/how-to-hack-roblox-games_GM431946152.pdf
    • http://beagle-cindy.de/images/coin-master-hack-apk-35-11_GM406889139.pdf
    • http://beagle-cindy.de/images/coin-master-hack-ios-2021_GM406889139.pdf
    • http://beagle-cindy.de/images/coin-master-free-shield_GM406889139.pdf
    • http://beagle-cindy.de/images/free-spin-link-for-coin-master-game_GM406889139.pdf
    • http://beagle-cindy.de/images/coin-master-free-attack_GM406889139.pdf
    • http://beagle-cindy.de/images/robux-match_GM431946152.pdf
    • http://beagle-cindy.de/images/roblox-bux-free_GM431946152.pdf
    • http://beagle-cindy.de/images/coin-master-free-spins-link-no-verification-2021_GM406889139.pdf
    • http://beagle-cindy.de/images/coin-master-free-stuff_GM406889139.pdf
    • http://beagle-cindy.de/images/coin-master-free-link-2021_GM406889139.pdf
    • http://beagle-cindy.de/images/coin-master-hack-download-ios_GM406889139.pdf
    • http://beagle-cindy.de/images/roblox-script-hack_GM431946152.pdf
    • http://beagle-cindy.de/images/if-i-uninstall-minecraft-can-i-reinstall-it-for-free_GM479516143.pdf
    • http://beagle-cindy.de/images/free-ways-to-get-robux_GM431946152.pdf
    • http://beagle-cindy.de/images/25-free-spins-coin-master_GM406889139.pdf
    • http://beagle-cindy.de/images/promo-code-free-robux_GM431946152.pdf
    • http://beagle-cindy.de/images/minecraft-pocket-apk_GM479516143.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047b6.bin
079f7f2e5bddec527762ae19b56974a6d0f4925d68fee8d05b03be801bb9a772		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47B6 27404 bytes
font_01_sfnt_off00008356.bin
4106291cd7227c0d53e90b177fe3a1aab46e5afbd3f4c663f2e449fd295445b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8356 18260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.