Malicious PDF — malware analysis report

Static analysis result for SHA-256 36957f44f6c9da40…

MALICIOUS

PDF

35.8 KB Created: 2021-06-30 21:34:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: e4485c5f453b76708c85a3ccb1099f84 SHA-1: 0448c405c019b1c7cf5b495a9aa14e71064af6cf SHA-256: 36957f44f6c9da401957b1dd64caa70e66b41a524a2c82d21b9b5a65ff13e528
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains a large number of embedded links, many of which are related to game hacks, suggesting a link farm or phishing attempt. The ML classifier also flagged this PDF as malicious with high confidence. The presence of numerous external URIs and the 'PDF_SEO_LINK_FARM' heuristic indicate a likely attempt to drive traffic to malicious sites or distribute further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/top-10-los-mejores-hack-de-roblox-game-hack PDF link annotation
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/minecraft-thumbnail-maker-free_GM479516143.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/prooving-that-how-to-get-free-cloths-e-free-roblox_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/super-nice-mml-hack-roblox_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/easiest-money-hack-febuary-roblox-rocitizens_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/roblox-speed-run-4-cheat_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/how-to-get-free-money-in-roblox-jailbreak-on-ipad_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/roblox-sword-art-online-burst-cheats_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/is-roblox-free-modelling-bad_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/comment-gagner-des-robux-sans-hack_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/free-robux-hack-no-human-verification_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/roblox-lumber-tycoon-2-money-hack-2021_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/roblox-immortality-hack_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/all-of-the-free-stuff-in-roblox_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/roblox-games-to-play-for-free-now_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/amazon-free-robux_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/counter-roblox-hack-aimbot-2021_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/roblox-any-way-to-make-robux-for-free_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/how-to-hack-destruction-simulator-roblox_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/free-robux-without-verification-2021_GM431946152.pdfIn PDF document text
    • http://e-learning.man3kotapadang.sch.id/__statics/gudangsoal/files/free-robux-generator-com-roblox-hack_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x32A0 22508 bytes
SHA-256: 04603fefc8d33e4cd34466774cfc798907fc02e7cec4a4cb80895bc7b251db35
font_01_sfnt_off000064e8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64E8 19664 bytes
SHA-256: 506396f25fc10165669780243e1eda8cf212bbce7bdfe7e3ec3f4adeb4aabb15

Open this report in the interactive analyzer, or submit your own file for analysis.