Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb9bc79704857bf0…

MALICIOUS

PDF

50.6 KB Created: 2021-05-12 02:38:57 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: e908410877dd2314df5559adf6372873 SHA-1: d4a407bcdd862da9b97992668553a924b50fbfc3 SHA-256: cb9bc79704857bf010c7196813aade03c9ceb65a8c365f9466068730d994dc50
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a lure related to game hacks and free in-game currency, directing users to a suspicious URL. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the lure suggest an attempt to redirect users to a malicious site, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8594

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-now-game-hack PDF link annotation
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/moonactive-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/free-t-shirt-roblox_GM431946152.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/coin-master-free-spins-link-2021_GM406889139.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/minecraft-free-ios-no-verification_GM479516143.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/how-do-you-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/minecraft-ps4-code-free_GM479516143.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/roblox-fun-com-free-robux_GM431946152.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/free-spins-coin-master-facebook_GM406889139.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/minecraft-education-free_GM479516143.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/best-way-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/coin-master-free-spins-links-2021_GM406889139.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/can-you-get-minecraft-windows-10-for-free_GM479516143.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/minecraft-alt-accounts-free_GM479516143.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/coin-master-free-spin-codes_GM406889139.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/100-free-spins-for-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/robux-gift-card-free_GM431946152.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/hacking-apps-for-roblox_GM431946152.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/coin-master-support_GM406889139.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/coin-master-hack-root_GM406889139.pdfIn PDF document text
    • http://preverjaboticabal.com.br/assets/uploads/canal_alpha/files/freespincoin-masterlinkdownload_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004dc1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4DC1 26240 bytes
SHA-256: 03cfb3768e1fa0dc7251123e25ad0ce2c66a6da719a2766c7e963ab6ba4ad805
font_01_sfnt_off00008a8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A8F 3464 bytes
SHA-256: 8e24205afdd13dcdea98f8150ef77dee4030e0e50a7c748783d1b4598e034a20
font_02_sfnt_off000096bf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x96BF 5696 bytes
SHA-256: 450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139
font_03_sfnt_off0000a3d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA3D1 18012 bytes
SHA-256: 787059e27c97fd95fc6b9dfcfe7cdf2b2341ddc13028adf5c554515b3b1d6c26

Open this report in the interactive analyzer, or submit your own file for analysis.