Malicious PDF — malware analysis report

Static analysis result for SHA-256 396fa41e0315163a…

MALICIOUS

PDF

31.8 KB Created: 2021-06-18 03:40:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 37eea4beba9bcff84a4f72cbed2305e1 SHA-1: de59d73304a472b18e5f1750d0f0d3cddd4dd03a SHA-256: 396fa41e0315163aa2cb41de41ac7ab89047483b0106e3f0fb1a4db3cb86f1e6
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are hosted on domains associated with SEO link farms and appear to offer game hacks and cheats. The document body explicitly mentions 'Hacks For Cb Roblox' and includes a call-to-action for a generator, indicating a lure for potentially malicious content. The presence of a PDF_SEO_LINK_FARM heuristic firing further supports the assessment of a malicious link distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/hacks-for-cb-roblox-game-hack PDF link annotation
    • http://reggieslockandkey.com/images/free-robux-human-verification_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/coin-master-daily-free-spins-hack_GM406889139.pdfIn PDF document text
    • http://reggieslockandkey.com/images/coin-master-free-cards-and-spin-link_GM406889139.pdfIn PDF document text
    • https://reggieslockandkey.com/images/roblox-how-to-hack-through-walls_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/coin-master-free-spins-link-blogspot-2021_GM406889139.pdfIn PDF document text
    • https://reggieslockandkey.com/images/google-how-do-you-get-free-robux_GM431946152.pdfIn PDF document text
    • https://reggieslockandkey.com/images/how-to-get-free-robux-easy-2021_GM431946152.pdfIn PDF document text
    • https://reggieslockandkey.com/images/how-to-get-minecraft-windows-10-for-free-2021_GM479516143.pdfIn PDF document text
    • https://reggieslockandkey.com/images/free-script-executor-roblox-2021-no-virus_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/how-do-you-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/how-to-get-java-minecraft-for-free_GM479516143.pdfIn PDF document text
    • https://reggieslockandkey.com/images/how-to-get-minecraft-pocket-edition-for-free_GM479516143.pdfIn PDF document text
    • https://reggieslockandkey.com/images/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdfIn PDF document text
    • http://reggieslockandkey.com/images/roblox-fly-hack-no-virus_GM431946152.pdfIn PDF document text
    • https://reggieslockandkey.com/images/freetako-roblox_GM431946152.pdfIn PDF document text
    • https://reggieslockandkey.com/images/minecraft-login-free_GM479516143.pdfIn PDF document text
    • https://reggieslockandkey.com/images/minecraft-hacked-client-112-2_GM479516143.pdfIn PDF document text
    • https://reggieslockandkey.com/images/cheat-code-hoverboard-ghost-simulator-roblox_GM431946152.pdfIn PDF document text
    • https://reggieslockandkey.com/images/coin-master-free-spin-and-coin-link-haktuts-hacking-news_GM406889139.pdfIn PDF document text
    • http://reggieslockandkey.com/images/dominus-roblox-free_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002a75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A75 21228 bytes
SHA-256: fa6ab4f272514b6e043e64842a272dd23b9e7c3d95c75798fe8b7d3a8c1c13f6
font_01_sfnt_off00005882.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5882 18636 bytes
SHA-256: 7c038f8610971033f0029f91a25e5d3e981334f66f872f398171bed445c909b6

Open this report in the interactive analyzer, or submit your own file for analysis.