Malicious PDF — malware analysis report

Static analysis result for SHA-256 13fd58e00c308ccd…

MALICIOUS

PDF

34.6 KB Created: 2021-06-28 10:57:51 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: b4e3a361f55b9232d636b7a71f56a72c SHA-1: 6a2822ec4f04d1877272b9a28deccd3feb3d985b SHA-256: 13fd58e00c308ccdf25e0a49b3463cec43cea2ffb1b53b0f2eec2b37cf51c281
182 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF document employs social engineering tactics, presenting itself as a free game hack to trick users into executing commands. The document instructs the user to copy and paste content into a terminal, which is a common lure for ClickFix attacks. The presence of numerous SEO-optimized links suggests a link farm designed to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/games-like-roblox-and-minecraft-but-free-game-hack
    • http://perpus.masda.ac.id//repository/no-human-verification_GM431946152.pdf
    • http://perpus.masda.ac.id/repository/how-do-i-become-a-hacker-on-roblox_GM431946152.pdf
    • http://perpus.masda.ac.id//repository/minecraft-hacks-18-9_GM479516143.pdf
    • http://perpus.masda.ac.id/repository/https-www-roblox-com-free-play_GM431946152.pdf
    • http://perpus.masda.ac.id/repository/free-face-roblox-face-anime-girl_GM431946152.pdf
    • http://perpus.masda.ac.id//repository/hack-version-of-coin-master_GM406889139.pdf
    • http://perpus.masda.ac.id/repository/copy-and-paste-to-terminal-robux-hack_GM431946152.pdf
    • http://perpus.masda.ac.id//repository/coin-master-daily-bonus_GM406889139.pdf
    • http://perpus.masda.ac.id/repository/free-robux-codes-that-r-rel_GM431946152.pdf
    • http://perpus.masda.ac.id/repository/ispoofer-pokemon-go-free-key_GM1094591345.pdf
    • http://perpus.masda.ac.id/repository/haw-to-get-free-items-in-roblox-taglog-2021-march_GM431946152.pdf
    • http://perpus.masda.ac.id/repository/coin-master-free-spins-and-coins-daily-links_GM406889139.pdf
    • http://perpus.masda.ac.id//repository/free-coin-master-spins_GM406889139.pdf
    • http://perpus.masda.ac.id/repository/how-to-get-free-robux-easy-on-pc_GM431946152.pdf
    • http://perpus.masda.ac.id/repository/free-robux-code-hack_GM431946152.pdf
    • http://perpus.masda.ac.id//repository/how-to-get-free-robux-without-downloading-anything_GM431946152.pdf
    • http://perpus.masda.ac.id//repository/legitimate-coin-master-free-spins-apk_GM406889139.pdf
    • http://perpus.masda.ac.id/repository/gabes-robux-hack_GM431946152.pdf
    • http://perpus.masda.ac.id/repository/roblox-tycoon-money-hack-cheat-engine-64_GM431946152.pdf
    • http://perpus.masda.ac.id/repository/roblox-cheat-engine-detection_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f91.bin
b3acfd1d8ddbf76d35d596e12885f043f3c9bcb5f44159bbe20290add9470681		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F91 22064 bytes
font_01_sfnt_off00006017.bin
f966747cd30c85933616b161cc2aef8dc37ca3bad1ce0a8758096995c9807db8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6017 19812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.