Malicious PDF — malware analysis report

Static analysis result for SHA-256 b313faa19e0f48e7…

MALICIOUS

PDF

43.3 KB Created: 2021-06-13 22:50:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 3b642b7a8b3162b4111a79d34a310927 SHA-1: 9d464ac2aeab4f9ad7baa21a00dbe1a85e4eb1ff SHA-256: b313faa19e0f48e7008c9670b38156f99981465fdbd1e0ab84ba39b8613a8cc7
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document was flagged by an ML classifier as malicious. It contains multiple embedded URLs pointing to external resources, including one that uses a raw IP address, suggesting an attempt to host malicious content. The document body, though partially corrupted, contains text related to game hacks and free in-game items, indicating a lure to trick users into downloading further malware. The presence of external URIs and the ML classification strongly suggest this document is part of a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/cbr-roblox-hacks-november-2021-game-hack PDF link annotation
    • http://103.68.2.77/__statics/gudangsoal/files/play-games-for-robux_GM431946152.pdfPDF link annotation
    • http://103.68.2.77/__statics/gudangsoal/files/free-robux-no-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-coin-master-coins_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/games-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/roblox-free-items-2021_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/minecraft-free-no-download_GM479516143.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/coin-master-free-coins_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-spin-app-coin-master_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-roblox-clothes-girl_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/cheats-for-titan-simulator-roblox_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-package-codes-roblox-2021-november-17_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/coin-master-hacks_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-coins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/coin-master-free-daily-spins-and-coins_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-more-robux-for-free_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-roblox-credit-for-free_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-earn-free-robux_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/daily-coin-master-free-spin-link_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/minecraft-story-mode-free_GM479516143.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-free-robux-no-verification_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000049ae.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x49AE 26192 bytes
SHA-256: 50d5297dbe7ba6685055e34d1a353149a1d93e9c181028cc13b0e7ca9fe100fb
font_01_sfnt_off000084df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84DF 18956 bytes
SHA-256: 45d2937732edc39ead59e8aecd621db4791c239ec70b2d4df4fd84f44728777b

Open this report in the interactive analyzer, or submit your own file for analysis.