Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e497c529197afc5…

MALICIOUS

PDF

33.1 KB Created: 2021-06-26 15:42:35 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-27
MD5: 1f3b71880211973eda0b35cc4bd4b685 SHA-1: 459c88ba79cd71d9ab2337d4d7793b2cbde90f12 SHA-256: 8e497c529197afc5dfafe6a31175da72a8835cdb57d58794de284d09ffa9f4a4
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded links that redirect to known malicious infrastructure, specifically advertising game hacks and cheats. The document body and extracted URLs strongly suggest a lure for downloading potentially unwanted or malicious software disguised as game enhancements. While no scripts were explicitly extracted, the presence of malicious redirector links and the nature of the lures indicate a high likelihood of a downloader or exploit delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/guudd.info-roblox-hack-download-game-hack In PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/free-minecraft-codes-2021_GM479516143.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/best-minecraft-hacks_GM479516143.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/freer-pro-tiktok-fans_GM835599320.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/coin-master-free-coins-2021_GM406889139.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/how-to-get-free-spins-and-coins-in-coin-master_GM406889139.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/how-to-hack-roblox-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/free-robux-link_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/tiktok-free-iphone-12_GM835599320.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/free-spins-coin-master-links-blogspot_GM406889139.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/free-robux-hack-no-verification_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/coin-master-unlimited-spins-hack_GM406889139.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/free-robux-no-human-verification-no-survey_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/coin-master-hack-software-download_GM406889139.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/coin-master-free-spins-for-today_GM406889139.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/how-to-play-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/how-to-be-a-hacker-on-roblox-2021_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/earn-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/how-much-robux-can-you-get-with-1-million-dollars_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/how-to-get-free-robux-august-2021-27th_GM431946152.pdfIn PDF document text
    • http://stikomyogyakarta.ac.id/ckfinder/userfiles/files/how-do-i-get-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C6D 21500 bytes
SHA-256: cf598f104572e939cc9da22276c0be36722255905a6ef98fff1d06592f2d3adc
font_01_sfnt_off00005b55.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B55 19488 bytes
SHA-256: e9a13b9b33664cfa1a81bbe1d6d2333f7024d2cea5a01662c3446871cb024382

Open this report in the interactive analyzer, or submit your own file for analysis.