Malicious PDF — malware analysis report

Static analysis result for SHA-256 0d24d836a1e0f703…

MALICIOUS

PDF

23.4 KB Created: 2021-07-07 21:13:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 271ba51bfb8d0e181794696a6f6cee3f SHA-1: 5edf8c49fa3796c78a733de12f5e66f01efae9a2 SHA-256: 0d24d836a1e0f70347c2cd47d4bbed86b6fcf77868277a6d7b4a2b1e597c2100
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains numerous links to external websites, many of which are related to game cheats and hacks for popular games like Coin Master and Roblox. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of such links, suggesting a tactic to attract users searching for these cheats. The primary malicious URL identified is http://netcdn.tw/app/406889139/coinmaster-rewards-game-hack, which likely hosts a malicious payload or phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9963

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coinmaster-rewards-game-hack
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/coin-master-free-spins-haktuts_GM406889139.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/coin-master-firebird-card-free_GM406889139.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/free-ways-to-get-robux_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/get-robux-for-free-2021_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/roblox-free-robux-no-verification_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/coin-master-hack-facebook_GM406889139.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-easy_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/hack-coin-master-apk_GM406889139.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/how-to-get-free-spins-on-coin-master-hack_GM406889139.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/games-like-minecraft-but-free_GM479516143.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/spin-rewards-coin-master_GM406889139.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/coin-master-hack-without-verification_GM406889139.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/how-to-speedhack-roblox-without-cheat-engine_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-100-real_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/tryrbx-site-free-robux_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/how-to-get-roblox-skins-for-free_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/free-robux-2021-promo-codes_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/free-robux-generator-no-human-verification-2021_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/how-to-get-robux-for-free-2021_GM431946152.pdf
    • https://elearning.min5bm.sch.id/__statics/gudangsoal/files/oprewards-login_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000032a8.bin
79dcd2664e8561753338c6e59c5c5b56239c5c173d8de61332d49c47b932fbb9		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32A8 18329 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.