Malicious PDF — malware analysis report

Static analysis result for SHA-256 85ebad56064e2bd4…

MALICIOUS

PDF

35.0 KB Created: 2021-07-09 07:51:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-05
MD5: cde7ae1ef53bb0164696f2ed6fc9f18e SHA-1: 14c0d78b7b97139ce9b98eb6be79593bf8c3a897 SHA-256: 85ebad56064e2bd41c0d6515d3d31dbd8f20f7e05a37cc419d2522388d74c1b7
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple links that redirect to a URL associated with game hacks and cheats. The ML classifier strongly indicates maliciousness, and the embedded links are designed to lure users to potentially malicious sites. While no scripts were directly executed, the PDF structure and embedded links suggest an attempt to redirect users to a second-stage payload or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-34-6-hack-game-hack PDF link annotation
    • http://www.donjastubica.hr/files/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://www.donjastubica.hr/files/coin-master-hack-ios-cydia_GM406889139.pdfIn PDF document text
    • http://www.donjastubica.hr/files/hack-coin-master-apk-358_GM406889139.pdfIn PDF document text
    • https://www.donjastubica.hr/files/free-robux-obbies-that-work_GM431946152.pdfIn PDF document text
    • http://www.donjastubica.hr/files/rc7-for-roblox-free_GM431946152.pdfIn PDF document text
    • https://www.donjastubica.hr/files/cool-free-halloween-costumes-roblox_GM431946152.pdfIn PDF document text
    • http://www.donjastubica.hr/files/synapse-roblox-free_GM431946152.pdfIn PDF document text
    • https://www.donjastubica.hr/files/free-robux-no-survey_GM431946152.pdfIn PDF document text
    • http://www.donjastubica.hr/files/easy-robux-hack_GM431946152.pdfIn PDF document text
    • https://www.donjastubica.hr/files/free-robux-no-human-verification-generator_GM431946152.pdfIn PDF document text
    • http://www.donjastubica.hr/files/roblox-super-power-training-simulator-hack-script-pastebin_GM431946152.pdfIn PDF document text
    • https://www.donjastubica.hr/files/free-robux-com-no-verification_GM431946152.pdfIn PDF document text
    • http://www.donjastubica.hr/files/how-to-get-free-robux-no-human-verification-2021_GM431946152.pdfIn PDF document text
    • https://www.donjastubica.hr/files/phantom-forces-roblox-hack-aimbot_GM431946152.pdfIn PDF document text
    • https://www.donjastubica.hr/files/how-to-get-a-gamepass-on-roblox-for-free-2021_GM431946152.pdfIn PDF document text
    • http://www.donjastubica.hr/files/free-robux-gift-card_GM431946152.pdfIn PDF document text
    • http://www.donjastubica.hr/files/free-robux-not-a-scam_GM431946152.pdfIn PDF document text
    • http://www.donjastubica.hr/files/free-robux-website_GM431946152.pdfIn PDF document text
    • https://www.donjastubica.hr/files/xray-hack_GM479516143.pdfIn PDF document text
    • https://www.donjastubica.hr/files/how-to-get-2021-robux-for-free_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000030f2.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x30F2 23308 bytes
SHA-256: 8082d17d671cace98b253a39280cfe933d62540609aa53b2d3442615ef850a6c
font_01_sfnt_off000065c2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65C2 18408 bytes
SHA-256: 771a2c558fbd10cbfd7734f1954a2b8d2b1d40b927f150a26b434975924ea7dc

Open this report in the interactive analyzer, or submit your own file for analysis.