Malicious PDF — malware analysis report

Static analysis result for SHA-256 e86dcc1953d33611…

MALICIOUS

PDF

34.4 KB Created: 2021-06-22 10:01:50 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: c980e187d3f727807c58bb8134ef74b4 SHA-1: 1ee4974eeac5434dbc801e6a909ee1aef9824b9e SHA-256: e86dcc1953d33611572fa485dae9d3f9400d377981235ffbb7f7b39295f063c8
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The document contains multiple embedded URLs and a prominent link in the document body, all related to obtaining free game items or accounts, which is a common lure for malware distribution. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious intent. The presence of these lures suggests the document is designed to trick users into downloading a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/479516143/minecraft-free-no-download-game-hack PDF link annotation
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/minecraft-java-account-free_GM479516143.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/how-to-get-minecraft-bedrock-for-free_GM479516143.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/free-robux-meme_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/rbx-gg-free-robux_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/coin-master-heaven-free-daily-spins_GM406889139.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/free-star-codes-roblox_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/minecraft-skins-download-free_GM479516143.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/how-to-change-roblox-username-for-free_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/minecraft-java-edition-redeem-code-free-2021_GM479516143.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/free-robux-codes-2021-real_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-no-human-verification_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/free-robux-without-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/minecraft-mods-download-free_GM479516143.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/free-robux-games-on-roblox_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/minecraft-xbox-one-edition-digital-code-free_GM479516143.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/coin-master-hack-download-2021_GM406889139.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/coin-master-free-2021-spin-link_GM406889139.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/free-robux-please_GM431946152.pdfIn PDF document text
    • http://elearning.mis-arrahmahuk.sch.id/__statics/gudangsoal/files/free-robux-legit_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32C3 22100 bytes
SHA-256: c1b80cb91192118079db37a8d62486c30d21a059e0073088aca7ba5d4f78cae1
font_01_sfnt_off00006316.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6316 18576 bytes
SHA-256: 821daecccb4d9802b425771331493e81bb578503857a5f1b541bc873f81a5cab

Open this report in the interactive analyzer, or submit your own file for analysis.