Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9debbe5ef7f4d4d…

MALICIOUS

PDF

42.4 KB Created: 2021-05-19 04:37:35 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6d78af676f5f6ed6303c964b5371d9a0 SHA-1: 6cffa58bc7c22e8f6b716365c609cd736ebdb7e6 SHA-256: b9debbe5ef7f4d4dda70aa6c78d739239fbdd25f72ee9327219589c136d51f9a
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains an embedded URL that impersonates Microsoft to lure users into downloading game cheats or currency. The ML classifier strongly flagged this PDF as malicious, and the presence of a call-to-action button further supports a phishing or malware distribution attempt. Although no scripts were directly extracted, the embedded URLs are the primary indicators of malicious intent, likely leading to a second-stage download or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://netcdn.xyz/app/1330123889/pubg-uc-purchase-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/1330123889/pubg-uc-purchase-game-hack PDF link annotation
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/free-roblox-shirts-templates_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/coin-master-free-spins-app_GM406889139.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/microsoft-rewards-roblox_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/how-to-get-free-robux-website_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/roblox-cheat_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/roblox-hack-download-pc_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/claimrobux-net_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/coin-master-hack-mod-apk-android-1_GM406889139.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/wurst-client-download_GM479516143.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/download-hacked-games-com-coin-master_GM406889139.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/robux-gift-card-free_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/coin-master-free-spinv1-0apkpure-com-apk_GM406889139.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/how-to-get-free-robux-without-downloading-any-apps_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/how-to-get-free-robux-without-any-verification_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/hack-coin-master-app_GM406889139.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/free-coins-coin-master-spins_GM406889139.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/coin-master-free-spins-only_GM406889139.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/how-do-you-get-roblox-for-free_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/how-can-you-get-free-robux_GM431946152.pdfIn PDF document text
    • https://www.gulfautotools.com/uploaded_files/userfiles/files/free-robux-no-download_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000496c.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x496C 25852 bytes
SHA-256: 04c90a9a51a3b76a9252efc2781164473460b1e50fe0c340c68a557cd5da93b2
font_01_sfnt_off000083aa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x83AA 18292 bytes
SHA-256: 9b3d4f4be72eb2ad087b0e55fa7ba760617e48de372d87d4ed48066cb703cfc9

Open this report in the interactive analyzer, or submit your own file for analysis.