Malicious PDF — malware analysis report

Static analysis result for SHA-256 b87376deca1749f2…

MALICIOUS

PDF

46.0 KB Created: 2021-05-13 13:50:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 23c691748ff4ea1b7b87913a92f32116 SHA-1: ae699f0f9a44162fb05910700510b519c346ec81 SHA-256: b87376deca1749f2cd5475b26d34210f47f756818ef9273adadff9f0e9908f7a
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a document body that attempts to lure the user into downloading game hacks, such as for Roblox and Minecraft. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple external URLs suggests a download or redirection attempt. While no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious document designed to trick users into downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9432

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-hack-ga-game-hack
    • http://projectunionstreet.com/library/repository/minecraft-build-hacks_GM479516143.pdf
    • http://projectunionstreet.com/library/repository/free-game-packs-for-coin-master_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/free-robux-hack-generator_GM431946152.pdf
    • http://projectunionstreet.com/library/repository/ww-roblox-come_GM431946152.pdf
    • http://projectunionstreet.com/library/repository/xray-mod-minecraft-114_GM479516143.pdf
    • http://projectunionstreet.com/library/repository/coin-master-free-spins-link-download_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/free-roblox-glasses_GM431946152.pdf
    • http://projectunionstreet.com/library/repository/freespinandcoinblogspot-com-2021-11-coinmasterfreespins_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/hack-coin-master-without-verification_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/coin-master-hack-xyz-2021_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/how-to-add-mods-to-minecraft-pe_GM479516143.pdf
    • http://projectunionstreet.com/library/repository/coin-master-links-for-today_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/how-do-you-earn-free-coins-for-coin-master_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/free-spins-coin-master-app_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/free-spins-on-coin-master_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/coin-master-free-spins-11-01-2021_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/roblox-hacks-and-cheats_GM431946152.pdf
    • http://projectunionstreet.com/library/repository/coin-master-daily-free-spins-link-2021_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/coin-master-free-400-spin-link_GM406889139.pdf
    • http://projectunionstreet.com/library/repository/how-to-hack-in-arsenal_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bb2.bin
907e9d73b1934dd128204d9f0f0fb49ff2173baecd38971c8677967a857cd34a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BB2 24412 bytes
font_01_sfnt_off000083e7.bin
515da38a799acdefd039af3a0dfb6ec4815b572058c9bd492ec5a77cd7658593		 pdf-font-stream PDF embedded font (sfnt) at offset 0x83E7 4008 bytes
font_02_sfnt_off00009172.bin
3275d650180bfb45a9fb7d5756aac43dcbbafe87c7818dab7a1b2e1f44194404		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9172 18184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.