Malicious PDF — malware analysis report

Static analysis result for SHA-256 95ea78cdf4df7572…

MALICIOUS

PDF

34.3 KB Created: 2021-07-06 09:03:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 9ae419d9fe03b0ad0e16ac1ff90bb93f SHA-1: 8182bddf64a786091cab679c756343d664b7388c SHA-256: 95ea78cdf4df7572959baefba74778ff1fa35dad7e68e5fc058d926d9df2ea1d
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains multiple embedded URLs and a prominent call-to-action in its body text, all related to downloading game hacks or cheats. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests that the downloaded content might be password-protected to evade security checks. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/free-coin-master-spins-link-download-game-hack
    • http://e-library.akbid-purworejo.ac.id//repository/coin-master-free-spins-apk_GM406889139.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/roblox-rape_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/free-coins-for-flip-master_GM406889139.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/free-robux-scam_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/how-to-hack-roblox-accounts-passwords_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/minecraft-bedrock-hacks-windows-10_GM479516143.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/roblox-getting-hacked_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id//repository/coin-master-free-cards-2021_GM406889139.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/roblox-dragon-ball-rage-cheats_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/free-spins-coin-master-october-13-2021_GM406889139.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/can-i-play-roblox-for-free_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/free-roblox-accessories_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/free-robux-gift-card-codes-2021_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/free-tiktok-followers_GM835599320.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/coin-master-free-coins-link-facebook_GM406889139.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/flying-in-roblox-hack_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/free-100-robux_GM431946152.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/coin-master-hack-spins-and-coins-unlimited-free-download_GM406889139.pdf
    • http://e-library.akbid-purworejo.ac.id/repository/coin-master-32-mod-hack-apk-download_GM406889139.pdf
    • http://e-library.akbid-purworejo.ac.id//repository/hack-coin-master-app_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00002e63.bin
54d652c23b54d69e0614cca3b6a2a4433388f9366a3a0e82f9c4aca45d6d020f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2E63 22712 bytes
font_01_sfnt_off0000615b.bin
27c8c61d44c060da30f6c9600d603766ffcc18b4584fd5ddfdc22e1ec1594314		 pdf-font-stream PDF embedded font (sfnt) at offset 0x615B 18924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.