Malicious PDF — malware analysis report

Static analysis result for SHA-256 3dc9dd79ba8ed710…

MALICIOUS

PDF

34.2 KB Created: 2021-06-30 10:05:52 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: c8927e13b34d192fc8bafc7b093b95f9 SHA-1: 519175339b7d0200810413d53697827257836917 SHA-256: 3dc9dd79ba8ed710dc00a7562ad7fe39216e50fd973956c28c401c1d13817998
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links and a document body that promotes game hacks and free virtual currency, indicating a phishing or scam attempt. The PDF_SEO_LINK_FARM heuristic suggests a large number of external links are present, likely leading to malicious sites. While no scripts were explicitly extracted, the presence of embedded URLs and the ML_NYX_PDF_MALICIOUS classification strongly suggest malicious intent, possibly involving JavaScript execution for further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-get-a-free-tail-on-roblox-game-hack PDF link annotation
    • http://pustaka.fkg.unand.ac.id/repository/free-robux-websites-that-work-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/hack-para-roblox-jailbreak-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/hack-trouver-les-mdp-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/how-to-hack-roblox-with-inspect-element-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/what-is-e-free-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/robux-free-fake_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/code-for-free-money-in-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/apocalypse-games-roblox-hack_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/roblox-portal-heroes-cheats_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/how-to-get-free-robux-no-download-or-survey-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/hack-para-roblox-2021-julio_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/do-surveys-for-free-robux_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/the-best-roblox-hack_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/roblox-old-accounts-for-free_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/roblox-gas-station-simulator-money-hack_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/how-to-hack-people-on-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/i-got-hacked-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/minecraft-java-edition-free-trial_GM479516143.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/hex-number-gives-free-robux-no-verification-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.fkg.unand.ac.id/repository/juego-de-roblox-hecho-por-un-hacker_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FEF 22092 bytes
SHA-256: dc4f5a6bfce9f8b7e7400bb18e5f85239caed70a776d1ce252c3450b98746373
font_01_sfnt_off0000609c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x609C 19036 bytes
SHA-256: f3e6bae7360a1c46094974e14d449d3f32fe92267fd6f47218c1242496e20ca9

Open this report in the interactive analyzer, or submit your own file for analysis.