Malicious PDF — malware analysis report

Static analysis result for SHA-256 abde82fd72b9508d…

MALICIOUS

PDF

36.8 KB Created: 2021-05-23 03:07:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 5931780d388c2ee35e99645ac6f50087 SHA-1: 7760ef82addd2b2b83efb56032c687de60acd712 SHA-256: abde82fd72b9508dd135ce0aa04ba178bd0655647d1a1afecd4252c683f24e1f
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a prominent call-to-action to download a file, disguised as free Minecraft printables. The ML classifier and PDF URI heuristic strongly indicate malicious intent, likely to deliver a second-stage payload. The document body explicitly contains the phrase 'CLICK HERE TO ACCESS MINECRAFT GENERATOR', further supporting a phishing or scam lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9447

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/free-minecraft-printables-game-hack
    • http://torkelson.se/images/robux-free-gift-card_GM431946152.pdf
    • http://torkelson.se/images/get-robux-com_GM431946152.pdf
    • http://torkelson.se/images/coin-master-no-download-app-but-play-for-free_GM406889139.pdf
    • http://torkelson.se/images/coin-master-32-hack-apk_GM406889139.pdf
    • http://torkelson.se/images/coin-master-coins-free_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003354.bin
8dad9ad9cb3524d47665ac6e1c63075fe0a2a82b85cce577dd2df42f49c304ae		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3354 26140 bytes
font_01_sfnt_off00006fa6.bin
e5df45a09fd76c24ea43a7fa28fc5fe559da15feee3d3577044ff876206ae01e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FA6 17956 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.