Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d86633500ee23f4…

MALICIOUS

PDF

42.1 KB Created: 2021-05-16 23:02:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c63d48aa5d1c31186f8aff32696c3441 SHA-1: 604bdbf163d273987e8fbd1911c314c9eb5f23cd SHA-256: 8d86633500ee23f4bfc85026e160a7f5f58af3e1397c8ff719479511ed8897f3
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure for a "Minecraft Hack Mod" and includes an external URI pointing to a suspicious URL. The document also contains heuristics indicating a remote-support tool lure and a visual download button, suggesting a social engineering attempt to trick the user into downloading and potentially executing a malicious payload. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 5

  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-hack-mod-game-hack
    • http://himalayandiscoverytrek.com/userfiles/files/minecraft-free-download_GM479516143.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/free-robux-reddit_GM431946152.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/coin-master-hack-unlimited-spins-apk-download_GM406889139.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/aristois-minecraft-hack_GM479516143.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/how-do-you-get-robux-on-roblox_GM431946152.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/coin-master-free-spins-daily-link-updated_GM406889139.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/robux-free-2021_GM431946152.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/hacker-minecraft-song_GM479516143.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/minecraft-windows-10-edition-hacked-client_GM479516143.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/coin-master-free-2021-spin-link_GM406889139.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/free-robux-gift-card_GM431946152.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/how-to-get-free-coins-in-coin-master-game_GM406889139.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/minecraft-hacked-client-18_GM479516143.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/mcpe-hacks_GM479516143.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/earn-free-robux-on-roblox_GM431946152.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/roblox-hack-ga_GM431946152.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/coin-master-online-hack-2021_GM406889139.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/coin-master-daily-free-spins-link-facebook_GM406889139.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/how-to-hack-roblox-accounts-2021_GM431946152.pdf
    • http://himalayandiscoverytrek.com/userfiles/files/coin-master-hack-coins_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004856.bin
64009e300ef3bf0dca8b6ef57653d642cfd1692cdc0dbeac1c5c6c346f2ca7a0		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4856 25596 bytes
font_01_sfnt_off000082cc.bin
c98163390533840513273057c02ab8b0002c23ddfc36b9b9583c7d176bc18763		 pdf-font-stream PDF embedded font (sfnt) at offset 0x82CC 18056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.