Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f5db6f868c2347f…

MALICIOUS

PDF

33.9 KB Created: 2021-07-05 14:09:06 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 2cd73687d75123f4f4b9e1963abf371d SHA-1: 33144746a800e132e61e98602f87ca54854c5240 SHA-256: 1f5db6f868c2347f3d878fc8582954ae3b1e36fd302f5164fd761fb8a2aba954
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links, many of which are structured as SEO-optimized URLs pointing to game-related content like Minecraft and Roblox. The presence of a PDF URI heuristic firing and the ML classifier's high confidence score indicate malicious intent, likely to direct users to malicious websites or download further payloads. No scripts were extracted, but the extensive link farm suggests a phishing or content-luring campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/minecraft-complete-handbook-game-hack PDF link annotation
    • http://lib.fisipumt.ac.id/repository/commenbt-hacker-un-compte-roblox-facile_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-skip-animation-roblox_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-minecraft-skin-maker_GM479516143.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/roblox-wifi-hack_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/coin-master-free-spins-and-coins-hack_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-download-roblox-cheats-hack-tool-v2-3_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/how-to-get-free-robux-no-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/how-to-get-a-lot-of-robux_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/shirt-roblox-free_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/cruise-ship-tycoon-cheat-roblox_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-robux-obby-by-roblox_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/free-spin-coin-master-2021-link_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/work-in-a-pizza-place-roblox-cheats_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/mega-roblox-hack-engine_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/free-robux-generator-no-verification_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-to-get-free-robux-with-inspect-console_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/get-coin-master-free-spin_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/moon-static-coin-master-generator-hacks-free_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/como-hackear-coin-master_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-ninja-animation-for-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003037.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3037 21776 bytes
SHA-256: 7d82d12a97fe0fb301306e81dede0ce46bb74f169df902b684cfa142b7eb08be
font_01_sfnt_off00005fd5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5FD5 19008 bytes
SHA-256: 3d4c969307bbdb220863567c701ff0e22ec78a4b6d04f35c3615ddb0a474c515

Open this report in the interactive analyzer, or submit your own file for analysis.