Malicious PDF — malware analysis report

Static analysis result for SHA-256 b75b487f46a21936…

MALICIOUS

PDF

42.4 KB Created: 2021-05-11 05:36:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 43ce8f11bfa9f969d2a11bd5c81059f6 SHA-1: cb42f4eba740a4d0da204eb946f78d52739915b3 SHA-256: b75b487f46a219367a25053aa6daca2678c90f47751faac586c6524aa60ce774
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links and a visual call-to-action button, directing users to download other PDF files hosted on external URLs. These linked files are also named suggestively, implying they contain game hacks or cheats. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of it being part of a phishing or malware distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robloxhacks-game-hack
    • http://217.165.206.12/userfiles/files/coin-master-hack-without-human-verification-2021_GM406889139.pdf
    • http://217.165.206.12/userfiles/files/minecraft-redeem-code-free_GM479516143.pdf
    • http://217.165.206.12/userfiles/files/hacks-for-minecraft-windows-10_GM479516143.pdf
    • http://217.165.206.12/userfiles/files/free-robux-games-that-actually-work_GM431946152.pdf
    • http://217.165.206.12/userfiles/files/how-to-hack-coin-master-spin_GM406889139.pdf
    • http://217.165.206.12/userfiles/files/free-robux-working_GM431946152.pdf
    • http://217.165.206.12/userfiles/files/coin-master-download_GM406889139.pdf
    • http://217.165.206.12/userfiles/files/worst-client_GM479516143.pdf
    • http://217.165.206.12/userfiles/files/how-to-get-minecraft-for-free-on-mobile_GM479516143.pdf
    • http://217.165.206.12/userfiles/files/chisel-and-bits-mod-minecraft-pe_GM479516143.pdf
    • http://217.165.206.12/userfiles/files/how-to-get-free-unlimited-robux_GM431946152.pdf
    • http://217.165.206.12/userfiles/files/free-robux-hacker-us_GM431946152.pdf
    • http://217.165.206.12/userfiles/files/all-coin-master-spin-link-and-free-download_GM406889139.pdf
    • http://217.165.206.12/userfiles/files/coin-master-free-coins-and-spins_GM406889139.pdf
    • http://217.165.206.12/userfiles/files/is-it-possible-to-get-free-robux_GM431946152.pdf
    • http://217.165.206.12/userfiles/files/free-redeem-code-for-coin-master_GM406889139.pdf
    • http://217.165.206.12/userfiles/files/free-robux-clothes_GM431946152.pdf
    • http://217.165.206.12/userfiles/files/free-robux-giveaway-live_GM431946152.pdf
    • http://217.165.206.12/userfiles/files/free-robux-codes-generator-no-verification_GM431946152.pdf
    • http://217.165.206.12/userfiles/files/online-coin-master-free-spin-app_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000048d2.bin
7c5e3a9e42d426b108835e5467c24ba288bbe811d487c1e8e5e6d0d09ad715ff
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x48D2 25796 bytes
font_01_sfnt_off0000834d.bin
4c82b5acf2344fb6074e769b7bb8f458d53ebd76102ce4f277dd7245c06f6447
pdf-font-stream PDF embedded font (sfnt) at offset 0x834D 18348 bytes