Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b020d8edb981da9…

MALICIOUS

PDF

34.5 KB Created: 2021-07-06 09:19:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: b191783f4d9b8fbf13618a0aae939b61 SHA-1: c9fe477ecc8613c9804003f488a95fedc1aaf742 SHA-256: 2b020d8edb981da98fd85e68f1a7c550127d23b83feaff771ead10ff95c2fe9d
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of embedded URLs, many of which are structured as SEO-optimized links to PDF files related to game hacks and cheats. The primary URL, http://netcdn.tw/app/406889139/fbchampion-game-hack, suggests a direct download lure. The ML classifier also flagged this PDF as malicious with high confidence, indicating a likely attempt to distribute malware or lead users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/fbchampion-game-hack
    • http://lib.bppsdmp.pertanian.go.id/ciawi/repository/how-to-hack-coin-master-ios-jailbreak_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/ciawi/repository/facebook-coin-master-hack_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/kupang/repository/coin-master-hack-version-download-2021-android_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/main/repository/roblox-how-to-get-robux-hack-2021_GM431946152.pdf
    • http://lib.bppsdmp.pertanian.go.id/main/repository/roblox-rewards-site_GM431946152.pdf
    • http://lib.bppsdmp.pertanian.go.id/kupang/repository/are-there-any-free-my-hero-academia-games-on-roblox_GM431946152.pdf
    • http://lib.bppsdmp.pertanian.go.id/ciawi/repository/roblox-speed-hack-booga-booga_GM431946152.pdf
    • http://lib.bppsdmp.pertanian.go.id/ciawi/repository/how-to-make-a-roblox-hack-with-notepad_GM431946152.pdf
    • http://lib.bppsdmp.pertanian.go.id/kupang/repository/coin-master-daily-free-spins-today_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/ciawi/repository/coin-master-daily-spins_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/main/repository/coin-master-hack-2021-apk_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/kupang/repository/prison-life-roblox-hacks_GM431946152.pdf
    • http://lib.bppsdmp.pertanian.go.id/main/repository/how-to-hack-mocap-dancing-in-roblox_GM431946152.pdf
    • http://lib.bppsdmp.pertanian.go.id/ciawi/repository/minecraft-svg-free_GM479516143.pdf
    • http://lib.bppsdmp.pertanian.go.id/ciawi/repository/como-ser-hacker-en-roblox-en-grand-blox-auto_GM431946152.pdf
    • http://lib.bppsdmp.pertanian.go.id/ciawi/repository/how-to-get-minecraft-pe-for-free-ios_GM479516143.pdf
    • http://lib.bppsdmp.pertanian.go.id/kupang/repository/coin-master-hack-no-verify_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/main/repository/coin-master-free-spins-deutsch-download-ios-link_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/main/repository/coin-master-free-spins-link-today-2021_GM406889139.pdf
    • http://lib.bppsdmp.pertanian.go.id/kupang/repository/free-spin-coin-master-iphone_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030b3.bin
6156d9d390fd259f99b5dd30ba7c946b2c6627a012f0ce704925e1c27503afd5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30B3 22680 bytes
font_01_sfnt_off00006362.bin
fb679c9250522cab0344be15c9898f12ed930a7de6dfe2591d59bad5f2ca43f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6362 18656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.