PDF static analysis report

Static analysis result for SHA-256 867277f42bf10b19…

SUSPICIOUS

PDF

46.4 KB Created: 2021-05-14 15:30:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 4918e7ef72fa7819289b0f9e8b560293 SHA-1: 69e032c9b816d3be2b990c89626fdc8466774897 SHA-256: 867277f42bf10b19039557dcc381c462db3f0d5bf989653f169a74ca09f3db3a
42 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple URLs pointing to external resources, likely intended to host malicious payloads. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs and a call-to-action phrase suggests a social engineering attempt to trick users into downloading further malware. No scripts were extracted, but the overall structure and heuristic firings indicate a downloader or dropper functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 3

  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-phantom-forces-hack-game-hack PDF link annotation
    • http://olimpik.mk/imagescke/upload/files/unlimited-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/free-roblox-shirt-templates-2021_GM431946152.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/minecraft-app-store-free_GM479516143.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/toolbox-for-minecraft-pe_GM479516143.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/master-coin-hack-app_GM406889139.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/coin-master-free-spins-app-for-iphone_GM406889139.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/minecraft-pocket-edition-free-download_GM479516143.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/free-robux-apps-that-work_GM431946152.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/free-minecraft-alt-accounts_GM479516143.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/hack-to-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/coin-master-hack-tool-v1-9-download_GM406889139.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/how-to-hack-someones-minecraft-account_GM479516143.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/coin-master-daily-free-spins_GM406889139.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/com-roblox_GM431946152.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/free-roblox-executor_GM431946152.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/buy-robux-free_GM431946152.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/how-do-i-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/free-robux-without-downloading-apps_GM431946152.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/no-human-verification-hack-for-coin-master_GM406889139.pdfIn PDF document text
    • http://olimpik.mk/imagescke/upload/files/coin-master-free-spins-twitter_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004b2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4B2C 29492 bytes
SHA-256: a20801dcf5838325edea59c82e187ebe1819c0b480a43b2f7f443c72bb54fe84
font_01_sfnt_off0000912c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x912C 19028 bytes
SHA-256: a1c2896b7dc960917d06e8f54c838956c7eaad0f88986fe011a2bb83a0b16557