Malicious PDF — malware analysis report

Static analysis result for SHA-256 36bf4752bd092f4b…

MALICIOUS

PDF

42.3 KB Created: 2021-05-17 06:28:58 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 86e66d9192f34a56c0bab00c578fb4d9 SHA-1: 72a00895b3468334be4d4b628376f7ac6cdca0a0 SHA-256: 36bf4752bd092f4b41b835a57df6c7e0c6585f96376a6c69b6ed5c8af196cf78
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links, many of which point to sites offering free game items or cheats, such as 'free robux' or 'minecraft free'. One prominent link directs to 'https://netcdn.xyz/app/479516143/windows-10-minecraft-free-with-java-game-hack'. The presence of a 'PDF_SEO_LINK_FARM' heuristic firing, along with a high ML score, indicates a malicious intent to redirect users to potentially harmful content. The document body, though partially corrupted, also contains a URL related to game cheats.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/windows-10-minecraft-free-with-java-game-hack
    • http://elitesoftsolutions.com/images/coin-master-free-link-daily_GM406889139.pdf
    • http://elitesoftsolutions.com/images/coin-master-daily-spin-free_GM406889139.pdf
    • http://elitesoftsolutions.com/images/coin-master-daily-free-spin-app_GM406889139.pdf
    • http://elitesoftsolutions.com/images/free-robux-no-generator_GM431946152.pdf
    • http://elitesoftsolutions.com/images/coin-master-free-spins-daily-2021_GM406889139.pdf
    • http://elitesoftsolutions.com/images/how-to-get-free-roebucks-on-roblox_GM431946152.pdf
    • http://elitesoftsolutions.com/images/wurst-18-9_GM479516143.pdf
    • http://elitesoftsolutions.com/images/free-robux-websites-that-actually-work_GM431946152.pdf
    • http://elitesoftsolutions.com/images/free-minecraft-java-server_GM479516143.pdf
    • http://elitesoftsolutions.com/images/how-you-get-free-robux_GM431946152.pdf
    • http://elitesoftsolutions.com/images/free-spin-sites-for-coin-master_GM406889139.pdf
    • http://elitesoftsolutions.com/images/earn-robux-websites_GM431946152.pdf
    • http://elitesoftsolutions.com/images/sites-for-free-spins-for-coin-master_GM406889139.pdf
    • http://elitesoftsolutions.com/images/coin-master-free-spins-and-cards_GM406889139.pdf
    • http://elitesoftsolutions.com/images/free-roblox-cards-pin-number_GM431946152.pdf
    • http://elitesoftsolutions.com/images/free-spins-coin-master-hack-2021_GM406889139.pdf
    • http://elitesoftsolutions.com/images/get-free-robux-without-doing-anything_GM431946152.pdf
    • http://elitesoftsolutions.com/images/free-robux-gen_GM431946152.pdf
    • http://elitesoftsolutions.com/images/coin-master-gold-cards-free-link_GM406889139.pdf
    • http://elitesoftsolutions.com/images/roblox-cp_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000048dd.bin
ac827ee8c69ee27a40cc67748dc10e4613a4428dee59a278550fec1b64cc4bb3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x48DD 24796 bytes
font_01_sfnt_off00008101.bin
9d6b9c54d2a131b4fb739230225618891bd38f691818b7a412f84340786b5520		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8101 18972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.