Malicious PDF — malware analysis report

Static analysis result for SHA-256 d11322a23d892ac3…

MALICIOUS

PDF

43.4 KB Created: 2021-05-19 10:22:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 14a86604d8286772ddf5de851bb01459 SHA-1: 53d893cdee513188309bb2c3688caa0b4d97af16 SHA-256: d11322a23d892ac3cc9dfd85c2cc48e7ee2a21126d01f0cad623a627d56bd630
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File T1059.007 JavaScript

This PDF document exhibits malicious behavior by embedding multiple URLs that likely lead to malicious downloads or further infection vectors. The document uses lures related to popular games like Minecraft and Roblox to entice users into clicking these links. Additionally, heuristics indicate the document may instruct users to interact with remote support tools or handle password-protected archives, suggesting a multi-stage attack designed to bypass security measures and trick the user into executing a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 5

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Remote-support tool lure high SE_REMOTE_SUPPORT_LURE
    Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/free-minecraft-servers-to-join-game-hack
    • http://szekelymozes.ro/images/free-spins-for-coin-master-on-1-19-19_GM406889139.pdf
    • http://szekelymozes.ro/images/free-roblox-outfits-2021_GM431946152.pdf
    • http://szekelymozes.ro/images/hack-coin-master-1_GM406889139.pdf
    • http://szekelymozes.ro/images/roblox-download_GM431946152.pdf
    • http://szekelymozes.ro/images/coin-master-heaven-free-daily-spins_GM406889139.pdf
    • http://szekelymozes.ro/images/javascript-free-robux_GM431946152.pdf
    • http://szekelymozes.ro/images/coin-master-hack-game-download-ios_GM406889139.pdf
    • http://szekelymozes.ro/images/coin-master-free-spin-and-coins-links_GM406889139.pdf
    • http://szekelymozes.ro/images/how-do-you-get-free-robux-on-roblox_GM431946152.pdf
    • http://szekelymozes.ro/images/jailbreak-roblox-hack_GM431946152.pdf
    • http://szekelymozes.ro/images/free-robux-generator-com-roblox-hack_GM431946152.pdf
    • http://szekelymozes.ro/images/free-hair-roblox-boy_GM431946152.pdf
    • http://szekelymozes.ro/images/how-to-get-free-robux-without-verifying-2021_GM431946152.pdf
    • http://szekelymozes.ro/images/coin-master-free-spins-link-june-2021_GM406889139.pdf
    • http://szekelymozes.ro/images/free-robux-picture_GM431946152.pdf
    • http://szekelymozes.ro/images/coin-master-free-coins-and-spins-app_GM406889139.pdf
    • http://szekelymozes.ro/images/how-to-get-free-roebucks-in-roblox_GM431946152.pdf
    • http://szekelymozes.ro/images/how-to-get-free-robux-on-pc_GM431946152.pdf
    • http://szekelymozes.ro/images/coin-master-free-spins-cheat-codes_GM406889139.pdf
    • http://szekelymozes.ro/images/coin-master-free-spin-best-link_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004da4.bin
d283ff1aa6d71a6474643976d5fc0615ee6c96f13f556a5e0df7aaa999daea88		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4DA4 25736 bytes
font_01_sfnt_off00008829.bin
f4dddb1eb99788babbc28e2933b16aea696a65c0930c8e69ff3f00d50dcb50ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8829 17992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.