PDF malware analysis — malicious · 0a22679ab24698d5

MALICIOUS

PDF

48.1 KB Created: 2021-06-10 21:48:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: ab8852d695f714db11ce57d6add4e59a SHA-1: a4cea4eeb30d9e6d949f8ba62485a8b2576fab83 SHA-256: 0a22679ab24698d5e1b0131844b4da2d76004a9ad2c85ceacb6e2927803f08ee

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are SEO-optimized and point to files related to game cheats and hacks. The presence of a 'download button' heuristic further suggests a deceptive intent. The document's primary function appears to be directing users to download potentially unwanted or malicious software disguised as game enhancements.

Machine Learning

Nyx PDF Classifier malicious score 0.9796

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/synapse-hack-roblox-anti-ban-game-hack
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/coin-master-free-chip_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/coin-master-32-mod-hack-apk-download_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/free-robux-generator-without-human-verification_GM431946152.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/como-conseguir-monedas-infinitas-y-tiradas-de-coin-master-hack_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/boost9-com-roblox-hack_GM431946152.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/coin-master-free-spins-2021-link_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/coin-master-hack-without-verification-2021_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/can-u-get-free-robux_GM431946152.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/youtube-how-to-get-free-robux_GM431946152.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/free-spin-hack-coin-master-2021_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/coin-master-free-shield_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/free-games-like-minecraft_GM479516143.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/coin-master-free-spin-27_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/free-spins-coin-master-generator_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/como-hackear-coin-master_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/get-free-spins-for-coin-master_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/roblox-hack-apk-download-android_GM431946152.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/coin-master-tiradas-gratis-2021_GM406889139.pdf
- https://darulfalah-tulungagung.com/__statics/gudangsoal/files/coin-master-daily-gifts_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000536b.bin` `711eb0c15c00a7f1f04dbc5b71065333d7fb489d048822fa87d58339b601fb80`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x536B	25904 bytes
`font_01_sfnt_off00008ddf.bin` `e9630f3bb738ae3bc329a423cf069c8035d70ce2227e3557c42815f85ad3284f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DDF	2852 bytes
`font_02_sfnt_off000097a0.bin` `2b7f95b343fe38ceb85b3aec5d8ddaeb0d0bb8460d6c3c29964010510942355c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x97A0	18764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.