Malicious PDF — malware analysis report

Static analysis result for SHA-256 b6c1fc858a184bb0…

MALICIOUS

PDF

35.0 KB Created: 2021-07-06 07:33:55 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: ce61a6b6972a1fae9bedb569b9abeddf SHA-1: 24c227ff1209f016a66932ef9022bb76ee45b716 SHA-256: b6c1fc858a184bb02c63bcae28c683778039820181e3da003e9f13860143150f
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a lure for game cheats and hacks, indicated by the document body and embedded URLs. The presence of a 'download button' heuristic and an external URI pointing to a suspicious domain suggests an attempt to trick the user into downloading a secondary payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/juego-hackeado-de-coin-master-game-hack
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/free-roblox-accounts-with-robux-2021-september_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/car-dealership-tycoon-roblox-hack_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/the-cheats-mac-roblox-free-robux_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/coin-master-hack-apk-no-survey_GM406889139.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/prison-life-roblox-hacks_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/roblox-promocodes-with-free-robux_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/girl-clothes-for-free-roblox_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/roblox-counter-strike-cheats_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/inject-hack-roblox-for-robux_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/websites-that-give-u-free-robux_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/coin-master-free-chip_GM406889139.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/jailbreak-download-free-roblox_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/getbucks-freecom-robux_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/free-robux-glitch-2021-working_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/dragon-ball-z-online-cheats-roblox_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/coin-master-free-spins-2021_GM406889139.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/how-to-hack-back-your-roblox-account_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/free-roblox-headphones_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib/repository/robux-hack-no-human-verification-or-survey-2021_GM431946152.pdf
    • http://perpustakaan.pt-yogyakarta.go.id/lib//repository/spin-coin_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000325f.bin
2c4cbd59c55bd64a6cd9b0f149834849ffa0002a52d0a7bc5eb38e68ce78df8f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x325F 22524 bytes
font_01_sfnt_off000064e5.bin
5920782670ae03dd8ff85db33b96364b1ba5d405613dcc56896acb5f3dd74354		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64E5 18652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.