Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ecaab8f2f015fd5…

MALICIOUS

PDF

35.1 KB Created: 2021-07-04 18:59:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: b7b5139f891864882071b71835d466b9 SHA-1: f07807d9e9b96082c2d46cf20c8a856e2a17b8cc SHA-256: 2ecaab8f2f015fd561b8dfbe1a6f18b32d8fbb7e384b0b1e8b662a922184ec2b
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous embedded URLs and a specific external URI pointing to game-related hacks and downloads. The ML classifier and PDF link farm heuristics strongly indicate malicious intent, likely to trick users into downloading malware or visiting malicious sites. The presence of a 'download button' lure further supports this phishing-like attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/free-minecraft-texture-packs-game-hack
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/are-minecraft-realms-free_GM479516143.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/wurst-hacked-client_GM479516143.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/free-robux-games-that-actually-work_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/hack-free-spin-coin-master_GM406889139.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/coin-master-spin-link-2021_GM406889139.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/hacks-for-roblox-that-arnt-pachted-2021_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/ultimate-free-spins-coin-master_GM406889139.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/free-robux-no-human-verification-trackid-sp006_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/offers-to-complete-and-get-free-spins-in-coin-master_GM406889139.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/how-to-get-a-free-dominus-in-roblox_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/instant-robux-hack_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/how-to-get-free-hair-in-roblox_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/hack-into-people-roblox-account-pastebin_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/free-robux-just-enter-username_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/cuenta-de-roblox-hacks_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/free-robux-2021-no-human-verification_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/free-roblox-dominus-toy-code_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-2021_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/cute-free-roblox-clothes_GM431946152.pdf
    • https://elearning.mtsn3kebumen.sch.id/__statics/gudangsoal/files/how-to-get-free-spins-on-coin-master-android_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033ce.bin
30a8d9ccacac11cb795b50063eab1a05bf9ef318dda812a9c4dcb01c3398cae2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33CE 22744 bytes
font_01_sfnt_off0000660a.bin
8f6189a23e9f62d3df147f8e0225ea745e729700ec556be14db5ff79dd0eb908		 pdf-font-stream PDF embedded font (sfnt) at offset 0x660A 18532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.