Malicious PDF — malware analysis report

Static analysis result for SHA-256 e177b26406b2bf92…

MALICIOUS

PDF

55.1 KB Created: 2021-05-17 16:32:50 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: a514cc18db535ef8f914da08059797ef SHA-1: 3bc7e5f3696f8c49c5e594ee7092e9fc58e0e434 SHA-256: e177b26406b2bf9263fe5e8bcf7e3c29d2d134a37136cff1de4663e629e8e0b7
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The document uses social engineering lures related to free Robux and game hacks to trick the user into downloading a malicious file. It also contains a heuristic indicating a browser extension or update installation lure, suggesting a multi-stage attack. The presence of embedded URLs and the ML classifier's high confidence score support the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8789

Heuristics 4

  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-2021-robux-game-hack
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-link-cheat_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/how-to-find-coin-master-free-spin-link_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/free-robux-ad_GM431946152.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-hack-online-download_GM406889139.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/roblox-script-executor-free_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/hack-download_GM431946152.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/free-minecraft-mods-for-xbox-one_GM479516143.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/how-to-get-free-unlimited-coins-in-coin-master_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-free-spin-app-2021_GM406889139.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux-instantly_GM431946152.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-free-stuff_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/best-free-robux-sites_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-2021-hack_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/free-spin-link-coin-master-today_GM406889139.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/send-me-500-2021-spins_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/sites-for-free-spins-for-coin-master_GM406889139.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/free-robux-com-2021_GM431946152.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/mcpe-optifine_GM479516143.pdf
    • https://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-online-hack-link_GM406889139.pdf
    • http://sman1negara.sch.id/new/public/ckfinder/userfiles/files/coin-master-hacks-free-spins_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004c6a.bin
b581826fd4d9baf3c8e1bdb994743bffdf98177d226d6f40942ffe32e4218660		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4C6A 26876 bytes
font_01_sfnt_off00008abd.bin
a2744590dc8d600f8e5da5007aa93e173eee747260e86e3b36d428902b36d5f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8ABD 8852 bytes
font_02_sfnt_off0000a786.bin
450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA786 5696 bytes
font_03_sfnt_off0000b498.bin
24dd33113ad1920a4b79572916f2875f9d05bd64d95cc44e0cd438e20c1ad4df		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB498 18416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.