Malicious PDF — malware analysis report

Static analysis result for SHA-256 1beb6ebb450c0a54…

MALICIOUS

PDF

46.7 KB Created: 2021-05-19 00:01:22 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: facb25968e0b77fd95992118e953d3cc SHA-1: 5c9656a8555fb584b7646c02a8fd810da50b775c SHA-256: 1beb6ebb450c0a542436daedbec46cba106c3dd69113f4e99f5eed0f438a4447
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF contains a large number of embedded links, many of which are SEO-optimized and point to sites offering free game currency or cheats. The primary external URL, https://netcdn.xyz/app/431946152/free-robux-mobile-game-hack, is likely a malicious landing page designed to trick users into downloading further malware or providing personal information. The document body, though partially corrupted, also contains references to free Robux and game hacks, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8948

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-mobile-game-hack
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/coin-master-links-free-spins_GM406889139.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/free-minecraft-server-hosting-24-7_GM479516143.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/how-to-get-free-robux-codes-2021_GM431946152.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/free-robux-no-human-verification-or-survey-2021_GM431946152.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/how-to-get-free-robux-without-download-apps-or-survey_GM431946152.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/google-coin-master-free-spins_GM406889139.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/free-robux-with-no-human-verification_GM431946152.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/how-to-get-minecraft-for-free-on-pc_GM479516143.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/mangocheats-com-hack-coin-master-cheat_GM406889139.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/free-star-codes-roblox_GM431946152.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/how-to-free-robux_GM431946152.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/how-to-hack-coin-master-computer_GM406889139.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/2021-free-spins-coin-master-link_GM406889139.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/coin-master-free-soins_GM406889139.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/google-how-do-you-get-free-robux_GM431946152.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/minecraft-tools_GM479516143.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/free-robux-generator-no-verification_GM431946152.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/reddit-coin-master-hack_GM406889139.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/hack-coin-master-apk_GM406889139.pdf
    • http://pkk.kom.smkn1losarang.sch.id/riped/perpustakaan/repository/free-roblox-characters_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004b77.bin
d868eebd90fb0470168f0a1eda24aff9fbca8373d73bafb520d9c7f0dfbe422c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B77 25600 bytes
font_01_sfnt_off000086db.bin
450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x86DB 5696 bytes
font_02_sfnt_off000093ed.bin
0c312729e80e6e0ca2ee9f4904992f86151ccd5d23fc73e43cbe09e8497f8a48		 pdf-font-stream PDF embedded font (sfnt) at offset 0x93ED 18404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.