Malicious PDF — malware analysis report

Static analysis result for SHA-256 8330c5df46ff178f…

MALICIOUS

PDF

48.3 KB Created: 2021-05-12 21:14:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 1c56d164ef824be2e8c3cacdad6f061a SHA-1: 581ea668972d63f3ddcb7cf4e5a6efdcd1806542 SHA-256: 8330c5df46ff178f3d22be6ef249236c3fbe85f482d0e1cd5bf928a7d07fdb96
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains embedded URLs and heuristics indicating it's a lure for downloading potentially malicious content, disguised as game-related downloads. The presence of a remote support tool lure suggests an attempt to gain unauthorized access or control. No scripts were extracted from this sample, but the embedded URLs and the nature of the lure point towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8715

Heuristics 4

  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-anarchy-server-no-hacks-game-hack
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/free-coin-master-spin-daily-link_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/roblox-no-download-hack_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/rbx-place-free-robux_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/op-rewards-free-robux_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/roblox-hacks-com_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/robux-hack-2021_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/coin-master-daily-rewards_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/minecraft-114-download_GM479516143.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/coin-master-free-spins-hack-2021_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/sites-to-get-free-robux_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/master-coin-free-link_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/coin-master-free-spons-apk-2021_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/coin-master-daily-free-spins-link-facebook_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/free-spins-coin-master-without-completing-offers_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/get-free-robux-without-human-verification_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/can-i-get-robux-for-free_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/how-to-hack-any-roblox-account_GM431946152.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/coin-master-hack-ios-10_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/daily-coin-master-free-spin-link_GM406889139.pdf
    • http://elearning.mtsn4madiun.sch.id/__statics/gudangsoal/files/coin-master-daily-free-spins-link-today-2021_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e8c.bin
e070a2a934e5ebf372f81cb94326b6f4eb8cf5d423295907119381f933004f92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E8C 24432 bytes
font_01_sfnt_off00008591.bin
f1a29adcea636583330be8db4f6466410de551ac48576b9e1aa5c34e2d665a1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8591 3020 bytes
font_02_sfnt_off00008fe6.bin
4555740682277f0055d57b15bd0ba953e5b51415ea3d21c93db391eace072d4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FE6 2816 bytes
font_03_sfnt_off000099f7.bin
25c1286fde013f5a892faec283bed83878941bbea70c27f39483b80af7cfb438		 pdf-font-stream PDF embedded font (sfnt) at offset 0x99F7 18340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.