Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c9ecf8783da5255…

MALICIOUS

PDF

35.6 KB Created: 2021-06-18 19:10:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 7ca5125deffa930b39255eba65d14a90 SHA-1: 0d73dc8e15bd0b3cbc4968fabec6b538a542034d SHA-256: 1c9ecf8783da5255ae1c52335a3233b3464cbfb832ccc2b4af3348693f508eac
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links that lead to external websites, many of which are structured as SEO link farms. These links promote the download of applications related to game cheats and hacks, such as for Roblox and Coin Master. The presence of a visual download button lure and the ML classifier flagging the PDF as malicious strongly suggest a malicious intent to redirect users to potentially harmful content or downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-codes-for-roblox-download-apk-game-hack
    • http://digilib.ulm.ac.id/pusat/repository/how-do-i-get-free-robux-easy_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/free-robux-place_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/free-roblox-executor-no-key_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-do-u-get-free-robux-2021_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/hack-coin-master-apk-ios_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-you-get-robux_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/code-for-free-roblox_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/free-coins-coin-master-daily_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/daily-free-spins-coin-master_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-to-get-a-free-keycard-in-roblox-jailbreak_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-to-get-free-robux-hack-2021_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/are-pubg-uc-free_GM1330123889.pdf
    • http://digilib.ulm.ac.id/pusat/repository/coin-master-free-spins-heaven_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/free-tiktok-followers-royal-key_GM835599320.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-to-get-more-free-coins-on-coin-master_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-to-get-robux-for-free-on-ipad-easy-2021_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/hack-coin-master-net_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-to-get-free-robux-hack-pc_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/get-free-robux-promo-codes_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/minecraft-linux-free_GM479516143.pdf
    • https://www.roblox.com/.I
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032e4.bin
fb0685af7bf14ae198aec1904106efcff902b1b08555a782adc68c62bc468906		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32E4 22404 bytes
font_01_sfnt_off00006497.bin
d198f777939ab575bc3fb9ef6e519d087291382ace7398d7ae2210fe371f60b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6497 19500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.