Malicious PDF — malware analysis report

Static analysis result for SHA-256 15242dc72b70b0b1…

MALICIOUS

PDF

45.9 KB Created: 2021-06-07 03:38:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: be1f5d71a7e77b75d909640c25c8d5a8 SHA-1: 312c72a75c5b816afa200740b00eca4287d3a158 SHA-256: 15242dc72b70b0b1ee747c7edad50245cdd5da7ba3e98535c11c2586ebf96a19
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links to external websites, many of which are related to free game items and hacks. The ML classifier strongly indicated maliciousness, and the presence of a link farm suggests a SEO-based malicious distribution strategy. The document body and embedded URLs indicate a lure for free game currency or items, likely leading to phishing or malware download sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-roblox-gift-card-redeem-codes-game-hack
    • http://digilib.pustaka.unand.ac.id/repository/free-minecraft-texture-packs_GM479516143.pdf
    • http://digilib.pustaka.unand.ac.id/repository/how-to-hack-a-minecraft-server_GM479516143.pdf
    • http://digilib.pustaka.unand.ac.id/repository/coin-master-free-spins-link-today_GM406889139.pdf
    • http://digilib.pustaka.unand.ac.id/repository/free-robux-no-verification_GM431946152.pdf
    • http://digilib.pustaka.unand.ac.id/repository/roblox-games-that-give-you-free-robux_GM431946152.pdf
    • http://digilib.pustaka.unand.ac.id/repository/free-robux-websites-no-human-verification_GM431946152.pdf
    • http://digilib.pustaka.unand.ac.id/repository/coin-master-free-spin-today_GM406889139.pdf
    • http://digilib.pustaka.unand.ac.id/repository/free-coin-master-spins-2021_GM406889139.pdf
    • http://digilib.pustaka.unand.ac.id/repository/claim-free-robux_GM431946152.pdf
    • http://digilib.pustaka.unand.ac.id/repository/minecraft-pe-015-0-apk-free-download_GM479516143.pdf
    • http://digilib.pustaka.unand.ac.id/repository/can-you-get-minecraft-for-free_GM479516143.pdf
    • http://digilib.pustaka.unand.ac.id/repository/was-minecraft-ever-free_GM479516143.pdf
    • http://digilib.pustaka.unand.ac.id/repository/free-spins-on-coin-master_GM406889139.pdf
    • http://digilib.pustaka.unand.ac.id/repository/free-robux-link_GM431946152.pdf
    • http://digilib.pustaka.unand.ac.id/repository/how-to-hack-people-on-roblox_GM431946152.pdf
    • http://digilib.pustaka.unand.ac.id/repository/coin-master-free-spins-and-coins-daily_GM406889139.pdf
    • http://digilib.pustaka.unand.ac.id/repository/how-to-make-a-minecraft-server-for-free_GM479516143.pdf
    • http://digilib.pustaka.unand.ac.id/repository/is-minecraft-free-on-xbox_GM479516143.pdf
    • http://digilib.pustaka.unand.ac.id/repository/free-minecraft-codes_GM479516143.pdf
    • http://digilib.pustaka.unand.ac.id/repository/how-to-spot-a-hacker-in-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000053de.bin
a48797a2deaa39e6d0bafa5b42f513b35827804b705d2107be6bf9f0085703a0		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x53DE 25808 bytes
font_01_sfnt_off00008f59.bin
a877533a93d805c3696c3de7a3eb8420a721cc7f8065bbf58bd3f0c206d1078c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F59 18836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.