Malicious PDF — malware analysis report

Static analysis result for SHA-256 addc774726acd5d1…

MALICIOUS

PDF

47.3 KB Created: 2021-05-12 20:06:36 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 48c48421f7df63545bda9393685c9383 SHA-1: 732a99fb9bb5f328673a11e39a712dc4c0f66262 SHA-256: addc774726acd5d138a9022c2057b97226281ee5c6ed6a32fdc33dcb1802c959
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents a lure for obtaining free game currency, specifically mentioning Minecraft and Coin Master, and includes a high-risk remote support lure. It contains numerous embedded URLs pointing to game-related hacks and cheats, suggesting the primary goal is to trick the user into downloading malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9013

Heuristics 5

  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/how-to-get-minecraft-coins-for-free-game-hack PDF link annotation
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-hack_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/extra-free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/get-free-coins-on-coin-master_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-free-pet-food-links_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/free-roblox-gift-card_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/how-to-get-1-million-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-hack-download_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/can-you-really-hack-coin-master-ios_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/robux-for-surveys_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/minecraft-114-download_GM479516143.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-free-spins-16-04-19_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/free-robux-hacks-no-verification_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/free-robux-generator-no-survey-no-download-no-human-verification_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-hack-no-verification_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-hack-fast_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/roblox-help-free-robux_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/robux-hacks-2021_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/facebook-coin-master_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/how-can-i-get-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000512b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x512B 26432 bytes
SHA-256: 44ac52378ca9cb8061ef2e3e35ef72855d021f68ee4212423c95dbd735cdf86b
font_01_sfnt_off00008d5f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8D5F 3092 bytes
SHA-256: 3811f2fb1880daf4953efcc9c7427d9b438bced237490b00be4a6ec3ecea79e0
font_02_sfnt_off0000980a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x980A 17872 bytes
SHA-256: 0037a1fc045e764a0a06593ed58f76bf502c93e6708a03a1db6b693a2071c675

Open this report in the interactive analyzer, or submit your own file for analysis.