Malicious PDF — malware analysis report

Static analysis result for SHA-256 8fee175cd41d04e9…

MALICIOUS

PDF

34.4 KB Created: 2021-06-27 07:46:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 35ae16025e1e5e7fda89a58c5dca04ad SHA-1: c7bd61e38044d48241a043ef93ba8853e5beea1c SHA-256: 8fee175cd41d04e9e3fa3cfc7f3f503906fa8899c9a52ff4169832ccf690739e
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous URLs pointing to sites offering game-related hacks and free accounts, indicating a phishing or scam attempt. The presence of a 'Password-protected archive handoff' heuristic suggests that the document may be designed to trick users into downloading an encrypted payload, which is then accompanied by password instructions to bypass security measures. While no scripts were explicitly extracted, the ML classifier strongly flagged this PDF as malicious, supporting the overall malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-account-in-roblox-2021-game-hack
    • http://smkn1salatiga.sch.id/library/repository/freer-tiktok_GM835599320.pdf
    • http://smkn1salatiga.sch.id/library/repository/free-minecraft-account-and-password-2021_GM479516143.pdf
    • http://smkn1salatiga.sch.id/library/repository/free-robux-card-codes-february-18-2021_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/free-spins-coin-master-2021-hack_GM406889139.pdf
    • http://smkn1salatiga.sch.id/library/repository/roblox-mcso-hack-script-pastebin_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/free-spins-on-coin-master-game_GM406889139.pdf
    • http://smkn1salatiga.sch.id/library/repository/coin-master-hacks-no-human-verification_GM406889139.pdf
    • http://smkn1salatiga.sch.id/library/repository/rbxboost-get-free-robux_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/free-robux-website-october-2021_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/coin-master-official-page_GM406889139.pdf
    • http://smkn1salatiga.sch.id/library/repository/hack-para-coin-master-singapore_GM406889139.pdf
    • http://smkn1salatiga.sch.id/library/repository/free-robux-obby_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/easy-robux-hack_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/rbxoffers-com-free-robux_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/roblox-generator-no-verification_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/how-to-get-free-robux-2021-november-no-human-verefication_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/minecraft-noob-vs-pro-vs-hacker-vs-god_GM479516143.pdf
    • http://smkn1salatiga.sch.id/library/repository/how-to-hack-coin-master-using-es-filer_GM406889139.pdf
    • http://smkn1salatiga.sch.id/library/repository/free-robux-without-verification-or-survey_GM431946152.pdf
    • http://smkn1salatiga.sch.id/library/repository/free-og-roblox-accounts_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fed.bin
c63d8c6690c94cbf4a64385f5b5cbe19750c65f92eee9b7fe61ac05c6f0df348		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FED 22032 bytes
font_01_sfnt_off00006098.bin
312d354958ef6ed6bc3c85e2ab5cfadeeafc719480420de844fbbcc577343459		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6098 19296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.