Malicious PDF — malware analysis report

Static analysis result for SHA-256 044e0dab17cb7fd3…

MALICIOUS

PDF

45.3 KB Created: 2021-05-19 16:30:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 76d8b2c023c3bc41561b7ed90142321b SHA-1: 20a7fe5dce2cb889d9a1e17fd309e12cc3045a12 SHA-256: 044e0dab17cb7fd3a207e065cc58511c9ae462943a48fad673f74564a21b2fd0
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs and a "link farm" heuristic, indicating a strong effort to redirect users to external sites. The document body and extracted URLs suggest a lure related to game cheats and hacks, such as "free coins" for Coin Master or "free robux" for Roblox. While no scripts were explicitly extracted, the PDF structure and the presence of external links strongly suggest it's designed to lead users to malicious content or phishing pages, likely leveraging T1059.007 (JavaScript) for PDF interactivity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9507

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/free-coins-coin-master-iphone-game-hack
    • http://juscor.com.br/ckfinder/userfiles/files/free-robux-no-email_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/how-to-get-free-clothes-on-roblox-2021_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/113-hacked-client_GM479516143.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/free-cracked-minecraft-server-hosting_GM479516143.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/free-spins-and-coins-com_GM406889139.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/coin-master-free-cards-hack_GM406889139.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/free-coin-master-androd-cheats-2021_GM406889139.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/free-robux-generator-2021-no-survey_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/roblox-prison-life-hack_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/coin-master-free-spins-cheat_GM406889139.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/how-to-get-free-roblox-premium_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/roblox-redeem-codes-free_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/roblox-robux-hack_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/coin-master-daily-free-spins-and-coins-2021_GM406889139.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/how-to-get-free-robux-no-human-verification_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/how-to-get-free-robux-app_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/reddit-coin-master-free-spins_GM406889139.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/coin-master-free-spins-may-11-2021_GM406889139.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/robux-generator-com_GM431946152.pdf
    • http://juscor.com.br/ckfinder/userfiles/files/coin-master-free-spin-ml_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004c91.bin
78ed61187890d2c2f824122e674a9d43dbb533258a23fa9a360bb3b2e6984919		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4C91 25392 bytes
font_01_sfnt_off0000858e.bin
10d025f04f706eb71cdda4f99784df1b9ccb52e48080e43095e0398eaef6f132		 pdf-font-stream PDF embedded font (sfnt) at offset 0x858E 2880 bytes
font_02_sfnt_off00008f79.bin
99dbb6b6b1c2666a4e7c95b3e8e09f0f63bf7a1f88354efaa1e52c2fabb98515		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F79 18052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.