Malicious PDF — malware analysis report

Static analysis result for SHA-256 b026d016a3a06488…

MALICIOUS

PDF

44.5 KB Created: 2021-05-11 16:13:19 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 18da2f7e9b53e9e41f527f4a31c07d5a SHA-1: 6a3cded22e767ae3e25d4a60a12c971b41faf185 SHA-256: b026d016a3a06488d41d5d789c6c982f765f092983ab5f67d0d39eddcb8c79d1
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains multiple URLs pointing to sites offering game hacks and cheats, indicating a lure to download malicious content. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests the downloaded content might be an encrypted archive, a common tactic to bypass security scans. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9632

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/mine-minecraft-games-for-free-game-hack
    • http://lib.icbc-indonesia.org//repository/install-coin-master_GM406889139.pdf
    • http://lib.icbc-indonesia.org//repository/free-robux-generator-for-roblox-2021_GM431946152.pdf
    • http://lib.icbc-indonesia.org/repository/master-free-spin-and-coin-link_GM406889139.pdf
    • http://lib.icbc-indonesia.org/repository/coin-master-spin-hack-2021_GM406889139.pdf
    • http://lib.icbc-indonesia.org//repository/daily-coin-master-free-spins_GM406889139.pdf
    • http://lib.icbc-indonesia.org/repository/free-coins-on-coin-master_GM406889139.pdf
    • http://lib.icbc-indonesia.org//repository/coin-master-daily-free-spins-haktuts_GM406889139.pdf
    • http://lib.icbc-indonesia.org//repository/i-want-free-robux_GM431946152.pdf
    • http://lib.icbc-indonesia.org/repository/coin-master-unlimited-spins-hack_GM406889139.pdf
    • http://lib.icbc-indonesia.org/repository/fake-robux-codes_GM431946152.pdf
    • http://lib.icbc-indonesia.org//repository/free-roblox-pin-codes_GM431946152.pdf
    • http://lib.icbc-indonesia.org/repository/free-spins-and-coins-coin-master-app_GM406889139.pdf
    • http://lib.icbc-indonesia.org/repository/minecraft-mac-free_GM479516143.pdf
    • http://lib.icbc-indonesia.org/repository/can-you-download-minecraft-for-free_GM479516143.pdf
    • http://lib.icbc-indonesia.org/repository/how-to-earn-robux_GM431946152.pdf
    • http://lib.icbc-indonesia.org//repository/roblox-old-avatar_GM431946152.pdf
    • http://lib.icbc-indonesia.org/repository/minecraft-free-online-games_GM479516143.pdf
    • http://lib.icbc-indonesia.org/repository/robuxmatchcon_GM431946152.pdf
    • http://lib.icbc-indonesia.org//repository/minecraft-hack-app_GM479516143.pdf
    • http://lib.icbc-indonesia.org/repository/free-ways-to-get-robux_GM431946152.pdf
    • https://freegiftcodes.eu
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004ab7.bin
4e692d1468469e00042ad35accaec5a9a0e74b51d0054fee9cc81a7da4183f81		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4AB7 24536 bytes
font_01_sfnt_off00008247.bin
3d2f34d044f6bbab651c9dbebb5fa2ab07f0b7854321761db770840783b352b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8247 2944 bytes
font_02_sfnt_off00008c73.bin
cadb606d3d0b8b0ab684217e51fa9c6d47dd4cc69c3dac55631094b48cac1516		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C73 17968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.