Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc7f52eef0e2479d…

MALICIOUS

PDF

40.7 KB Created: 2021-05-20 00:18:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: a59649a872485e160d2cebeb23f11113 SHA-1: 3308c902c781819bc96b0f6799e8f40c26ebdc8e SHA-256: fc7f52eef0e2479d86a259be851b80f9a1633e8af50df8fab72237c2aa1383d2
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a visual download lure, strongly suggesting an attempt to trick the user into downloading malicious content. The ML classifier also flagged this PDF with high confidence. The primary URL, https://netcdn.xyz/app/479516143/minecraft-tools-game-hack, appears to be the main lure for this attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-tools-game-hack
    • https://lib-stie.yai.ac.id/repository/coin-master-hack-2021_GM406889139.pdf
    • https://lib-stie.yai.ac.id/repository/free-roblox-accounts-with-robux-that-work-not-banned-2021_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/coin-master-free-daily-spins_GM406889139.pdf
    • https://lib-stie.yai.ac.id/repository/roblox-free-robux-no-verification_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/free-robux-generator-no-verification-2021_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/easy-how-to-get-free-robux_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/roblox-land-free-robux_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/pokemon-go-free-remote-raid-pass-january-2021_GM1094591345.pdf
    • https://lib-stie.yai.ac.id/repository/apps-to-get-free-robux_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/coin-master-daily-free-spins-link-today_GM406889139.pdf
    • https://lib-stie.yai.ac.id/repository/coin-master-free-cards-link_GM406889139.pdf
    • https://lib-stie.yai.ac.id/repository/blox-fish-free-robux_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/free-robux-no-verify-2021_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/roblox-hack-me-robux_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/moonactive-coin-master-free-spins_GM406889139.pdf
    • https://lib-stie.yai.ac.id/repository/coin-master-daily-free-spins-link-app_GM406889139.pdf
    • https://lib-stie.yai.ac.id/repository/free-robux-only-1-step_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/roblox-free-robux-codes_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/roblox-free-clothes-hack_GM431946152.pdf
    • https://lib-stie.yai.ac.id/repository/100-free-spins-coin-master_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000464c.bin
7cbc63c37a712028403124d4e7980ac39aa5cbf782a6a41a4f0e04962d6729d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x464C 24484 bytes
font_01_sfnt_off00007e14.bin
2a833d33c5ebf10caee2e4c1b445a2173c9d4c016a2b5c4a8254ba70d54254b8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E14 17784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.