Malicious PDF — malware analysis report

Static analysis result for SHA-256 d22eec8d00c11e87…

MALICIOUS

PDF

46.9 KB Created: 2021-05-19 22:33:19 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: ba2c76b729f09b24c1331151919547ea SHA-1: 6c57232e8809961e856cc132651da382b63c98fc SHA-256: d22eec8d00c11e8751cd4cd8abd4b14e1689b2ead60787152f3236c90de261d9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs advertising game hacks and in-game currency, suggesting a lure for users to download malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs and a raw IP address further supports this assessment. The document's content and structure are consistent with a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 4

  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/1330123889/pubg-uc-buy-paytm-game-hack
    • http://183.91.70.7//repository/coin-master-game-hacks_GM406889139.pdf
    • http://183.91.70.7//repository/how-can-you-get-minecraft-for-free_GM479516143.pdf
    • http://183.91.70.7/repository/how-to-get-minecraft-java-for-free_GM479516143.pdf
    • http://183.91.70.7//repository/cute-free-roblox-outfits_GM431946152.pdf
    • http://183.91.70.7/repository/coin-master-spins-hack_GM406889139.pdf
    • http://183.91.70.7//repository/minecraft-116-apk-download_GM479516143.pdf
    • http://183.91.70.7//repository/coin-master-apk-hack-mod-download_GM406889139.pdf
    • http://183.91.70.7/repository/coin-master-hack-ios-2021_GM406889139.pdf
    • http://183.91.70.7/repository/where-to-get-robux_GM431946152.pdf
    • http://183.91.70.7/repository/coin-master-free-spins-link-iphone_GM406889139.pdf
    • http://183.91.70.7//repository/free-coin-master-generator_GM406889139.pdf
    • http://183.91.70.7/repository/2021-free-coin-master-spins_GM406889139.pdf
    • http://183.91.70.7//repository/can-i-get-robux-for-free_GM431946152.pdf
    • http://183.91.70.7//repository/download-apk-tiktok-free_GM835599320.pdf
    • http://183.91.70.7//repository/coin-master-hack-link_GM406889139.pdf
    • http://183.91.70.7//repository/coin-master-free-cards_GM406889139.pdf
    • http://183.91.70.7//repository/how-to-get-free-robux-easy-2021_GM431946152.pdf
    • http://183.91.70.7/repository/free-robux-not-a-scam_GM431946152.pdf
    • http://183.91.70.7/repository/robux-generator-no-human-verification-2021_GM431946152.pdf
    • http://183.91.70.7//repository/minecraft-116-1-download_GM479516143.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004e35.bin
0faed856b12afcef61f8360106b3862e22aba4dc88143422e6d05763ae14cb7c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E35 32360 bytes
font_01_sfnt_off00009449.bin
12b72997edb7f196851327dd04af93a6f1cfe661b5bfe3cb4274a77e7104bb45		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9449 18672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.