Malicious PDF — malware analysis report

Static analysis result for SHA-256 7735ad39c172ec87…

MALICIOUS

PDF

46.3 KB Created: 2021-05-21 21:37:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 39988a375ddff960931eeaf161bbb932 SHA-1: 7e07cf5b47f17043c8fe56b5a1e3a9fed42a9c18 SHA-256: 7735ad39c172ec874b06d2311be64dafc9b772660c943305067281941da71d24
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains embedded URLs and text that lure users with promises of game hacks and generators, specifically for Roblox and Coin Master. It also contains instructions to disable security software, a common tactic for malware delivery. The ML classifier also flagged this PDF as malicious. No scripts were extracted, but the embedded URLs suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7409

Heuristics 4

  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-hack-a-roblox-account-easy-game-hack
    • http://www.thecoffeebaron.co.za/images/free-links-for-coin-master_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/coin-master-free-chest-link_GM406889139.pdf
    • http://www.thecoffeebaron.co.za/images/how-to-get-free-robux-instantly_GM431946152.pdf
    • http://www.thecoffeebaron.co.za/images/how-to-get-hacks-on-minecraft_GM479516143.pdf
    • http://www.thecoffeebaron.co.za/images/get-robux-com_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003e95.bin
7166290e9185a7f8fcb783c9ec82f5b696180300738f240b55d3560d3e2a437d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3E95 28348 bytes
font_01_sfnt_off0000805a.bin
4a13d5d8cb047d0703728abd56fadd7857e02dd2d0bdc744bf23c6d558594edd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x805A 7436 bytes
font_02_sfnt_off0000925b.bin
f0aa2a8f008262e8aa636f08cdffff7c9568ae6e0bf5f389be1472b9a6879674		 pdf-font-stream PDF embedded font (sfnt) at offset 0x925B 18772 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.