Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f9abe6aac035e2a…

MALICIOUS

PDF

35.1 KB Created: 2021-06-19 00:20:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: affe84d7d47f780bc92a1cee52564175 SHA-1: bccecc8d1992395e488866c690f37db61b92be8a SHA-256: 1f9abe6aac035e2a6bf892023d066645ac638022dc7323b2fd39d20078277157
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document employs a common lure of game cheats and free items to trick users into clicking malicious links. The document contains multiple embedded URIs, including one pointing to an IP address, that lead to websites hosting further PDF lures or potentially malicious content. The ML classifier strongly indicated maliciousness, supporting the observed redirection and lure techniques.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 5

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/cops-and-robbers-roblox-cheat-game-hack PDF link annotation
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-free-airpods-tiktok_GM835599320.pdfPDF link annotation
    • http://103.68.2.77/__statics/gudangsoal/files/roblox-free-robux-website_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/coin-master-free-spins-hack-link_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-robux-for-free-2021-for-kids_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/roblox-red-free-pants_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-working-roblox-cards_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-a-hacker-out-of-your-roblox-account_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/roblox-free-name-change_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-tiktok-followers-app_GM835599320.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/chronosploit-roblox-hack_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/boga-boga-roblox-hack_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-hack-roblox-2021_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/best-roblox-hacks_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/tiktok-free-pizza_GM835599320.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/free-robux-games_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/a-bizzare-day-hack-script-roblox_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/hack-roblox-online-no-survey_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/hacking-code-text-chat-roblox_GM431946152.pdfIn PDF document text
    • http://103.68.2.77/__statics/gudangsoal/files/how-to-get-free-robux-no-verification_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032a4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32A4 22200 bytes
SHA-256: a46ec25023bbc5f3826a2766b4a47018a9bf9e7338b345d171bf5d1fcc122703
font_01_sfnt_off000063e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63E0 19104 bytes
SHA-256: 06e3edb60ad6b22f898c5b06c836c8416bd75796af2f7bc3476cba314e640508

Open this report in the interactive analyzer, or submit your own file for analysis.