Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f1f20a5914b4b25…

MALICIOUS

PDF

42.8 KB Created: 2021-05-25 09:30:43 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 1558170b33b2744282799e249578758d SHA-1: e6012ceca07cc5bc1d7c0c8e7347952611c0bc04 SHA-256: 8f1f20a5914b4b253eff6fbe09f90a50091f877c0c92fcfc2042838c980ad039
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs and a prominent call-to-action to download free in-game currency for Coin Master. One of the embedded URIs points to a raw IP address, which is a strong indicator of malicious intent. The ML classifier also flagged this PDF as malicious. The document body and embedded links suggest a phishing or scam attempt to redirect users to malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8013

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-free-daily-spins-and-coins-game-hack
    • http://103.68.2.77/__statics/gudangsoal/files/coin-master-bonus_GM406889139.pdf
    • http://103.68.2.77/__statics/gudangsoal/files/coin-master-free-2021-spin-link_GM406889139.pdf
    • http://103.68.2.77/__statics/gudangsoal/files/pokemon-go-free-trades_GM1094591345.pdf
    • http://103.68.2.77/__statics/gudangsoal/files/coin-master-daily-free-spins-link-today_GM406889139.pdf
    • http://103.68.2.77/__statics/gudangsoal/files/master-coin-free-link_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000033d1.bin
2119dfd676484b9cc566a4091c01552bea0ec04f5f63a04e889ada94d451c94a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x33D1 24936 bytes
font_01_sfnt_off00006d14.bin
e19229282826e6d52caa26c8375af19ab77bd3f57048dc578a6e669876579f2d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D14 4128 bytes
font_02_sfnt_off00007b37.bin
6fd7c7f447d66842f81aa8cf197935b17f22157d0c7e9f95622df1b5b4ddf530		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B37 2788 bytes
font_03_sfnt_off00008526.bin
88c5a76ee56cb7e28b06cf9e90949f5a0fd4a72b6dddac6cb3c8c84aebf5620b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8526 18480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.