Malicious PDF — malware analysis report

Static analysis result for SHA-256 be3c996941fb29a5…

MALICIOUS

PDF

46.7 KB Created: 2021-05-19 02:07:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 490057d9fe3ed0ddb3d186d03cfb1f86 SHA-1: bc767b0c30e915c54ff22790dc95f9b514932713 SHA-256: be3c996941fb29a5b025c3d17e2158489500c6ffbb4a13d57dd43fd74aca858c
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF document exhibits malicious characteristics, including a lure for a remote support tool and a visual download button, suggesting an attempt to trick the user into executing a payload. The document contains numerous embedded URLs pointing to potentially malicious content, such as game hacks and free spins, which are likely used to download further malware or lead the user to phishing sites. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 4

  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-windows-10-edition-unlock-full-game-free-game-hack
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/is-minecraft-java-edition-free_GM479516143.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/coin-master-free-spins-cash_GM406889139.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/how-do-you-earn-robux-on-roblox_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/how-to-get-free-robux-on-roblox-2021_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/free-spins-coin-master-ios-links_GM406889139.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/coin-master-free-cards_GM406889139.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/coin-master-daily-free-spin-and-coin-link-haktuts_GM406889139.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/earn-robux-websites_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/free-roblox-cards-pin-number_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/coin-master-free-spin-ml_GM406889139.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/pubg-uc-download_GM1330123889.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/free-roblox-premium_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/free-robux-codes-generator-no-verification_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/free-spins-coin-master-daily_GM406889139.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/coin-master-2021-free-spins-link-blogspot_GM406889139.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/lazyblocks-com-free-robux_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/coin-master-free-spins-and-free-coins_GM406889139.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/free-robux-sites-2021_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/free-robux-generator-2021_GM431946152.pdf
    • http://mtsn4.ykt.my.id/__statics/gudangsoal/files/roblox-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004dc3.bin
771806e5204d74167a2b2b0f9ffb22a0b7d415b592617e83e8c66ff4db92e958		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4DC3 32624 bytes
font_01_sfnt_off0000913b.bin
614bd227759a0900337b007d73888638d95591a994554acf55d00d578ccef1d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x913B 19356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.