Malicious PDF — malware analysis report

Static analysis result for SHA-256 0266a1d7b4d2ddb9…

MALICIOUS

PDF

34.6 KB Created: 2021-06-20 08:49:27 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 81f44f4d3b22db7ab8ea332507f60aee SHA-1: 3e61e8b539ef0a2758b6412e7b2f831b13156dfe SHA-256: 0266a1d7b4d2ddb994ed1b96e599a7cab6ea93629323c0bb6114be7129e6845e
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are SEO-optimized PDFs related to game cheats and in-game currency. The ML classifier and PDF link farm heuristics strongly indicate malicious intent, likely to direct users to download malicious files or visit phishing sites. No scripts were extracted, but the overall structure and embedded links suggest a lure for users seeking game exploits.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-cheat-codes-for-iphone-game-hack PDF link annotation
    • http://reggieslockandkey.com/images/how-to-get-free-builders-club-on-roblox_GM431946152.pdfIn PDF document text
    • https://reggieslockandkey.com/images/coin-master-free-spins-link-2021-today_GM406889139.pdfIn PDF document text
    • http://reggieslockandkey.com/images/play-coin-master-online-free_GM406889139.pdfIn PDF document text
    • https://reggieslockandkey.com/images/mine-minecraft-games-for-free_GM479516143.pdfIn PDF document text
    • https://reggieslockandkey.com/images/can-i-play-minecraft-for-free_GM479516143.pdfIn PDF document text
    • https://reggieslockandkey.com/images/free-minecraft-wallpaper_GM479516143.pdfIn PDF document text
    • http://reggieslockandkey.com/images/how-to-get-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/get-robux-for-free-generator_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/free-roblox-adopt-me-bucks-cheat_GM431946152.pdfIn PDF document text
    • https://reggieslockandkey.com/images/coin-master-free-soins_GM406889139.pdfIn PDF document text
    • http://reggieslockandkey.com/images/minecraft-hacked-apk_GM479516143.pdfIn PDF document text
    • https://reggieslockandkey.com/images/ulgamesresources-com-free-robux_GM431946152.pdfIn PDF document text
    • https://reggieslockandkey.com/images/como-atravesar-paredes-en-roblox-jailbreak-hack_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/how-to-get-free-roblox_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/how-do-you-put-codto-get-free-robuxe_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/roblox-mining-tycoon-hack_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/roblox-free-robux-simulator_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/free-spin-coin-master-2021_GM406889139.pdfIn PDF document text
    • https://reggieslockandkey.com/images/coin-master-free-link_GM406889139.pdfIn PDF document text
    • https://reggieslockandkey.com/images/minecraft-education-free_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fc9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FC9 22412 bytes
SHA-256: bb7e4ecbd53e3dc16d2fdb579877fc59b832fd38bca12e3a21265dd34eac099f
font_01_sfnt_off0000617a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x617A 19272 bytes
SHA-256: b87c78c4e9f30010771804e56f9cc44d6e0982bae464a3da2e41b25eb1138514

Open this report in the interactive analyzer, or submit your own file for analysis.