PDF static analysis report

Static analysis result for SHA-256 c4c1fe12cbe7e992…

SUSPICIOUS

PDF

40.3 KB Created: 2021-07-09 00:25:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 491b073ad77ca63f013f9280d17c2fcb SHA-1: d7450a6e28345388710e057d34842229e55cb2a1 SHA-256: c4c1fe12cbe7e9927eb71bf5b76799e06ca88b63cdc856a68dbce2e56f6909a4
50 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded JavaScript and external URIs that point to download sites for game hacks and cheats. The ML classifier strongly flagged this PDF as malicious, and the presence of a download button heuristic further supports the lure of downloading potentially unwanted software. The primary malicious URL identified is http://netcdn.tw/app/479516143/minecraft-hacked-client-112-2-game-hack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9659

Heuristics 4

  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/minecraft-hacked-client-112-2-game-hack PDF link annotation
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/free-roblox-outfits-2021_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/com-roblox_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/coin-master-free-spins-today-new_GM406889139.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/easy-robux-hack_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/como-tener-robux-gratis-sin-hack-2021_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/how-to-earn-robux-by-playing-games_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/2021-unpatchable-how-to-noclip-hack-on-roblox_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/roblox-builders-club-free_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/coin-master-hack-unlimited-spins-apk_GM406889139.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/how-to-make-your-roblox-shirt-free_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/coin-master-hack-apk-free-download_GM406889139.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/roblox-piano-hack_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/how-can-i-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/bloxpink-free-robux_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/fake-hack-code-copy-and-paste-for-roblox_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/crimson-roblox-hack_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/minecraft-app-store-free_GM479516143.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/speed-city-roblox-hack_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/how-to-get-free-faces-on-roblox-2021-on-computer_GM431946152.pdfIn PDF document text
    • http://www.erealitysolutions.com/assets/dealercmslogin/js/ckfinder/userfiles/files/roblox-free-body_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003414.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3414 22580 bytes
SHA-256: bdba7ad5cd1510c5b948d25f6595a1bcb45386765215aa2422fe91429298e46a
font_01_sfnt_off00006631.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6631 2848 bytes
SHA-256: e494dfbc17a31b8b677e20f5e37602c538292163208a26380855969ce973a69b
font_02_sfnt_off00006fe6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6FE6 2800 bytes
SHA-256: 1756bf2370268b82899ca819fa059e16c32fca103da24d388e887c3e7a349852
font_03_sfnt_off000079dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79DD 18504 bytes
SHA-256: 7d083d3a15ead7460ad8e45f375fb199430cdb89a1cd4a9888d4caef1733d6f3