Malicious PDF — malware analysis report

Static analysis result for SHA-256 47224edd9a946c18…

MALICIOUS

PDF

36.0 KB Created: 2021-06-30 05:52:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 6ac00d59de5551ad71b1625378565c23 SHA-1: 7ffb43d8dd1834d75f38008694e05e1a9d659db6 SHA-256: 47224edd9a946c18d39b1b0a620647a9e8709087176f2be6d5f800e3736a0df2
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a large number of external links, many of which are related to game hacks and cheats, suggesting a lure to malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous embedded URLs supports this finding. The document's structure and content indicate an attempt to trick users into clicking these links, likely leading to malware download or exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-bypass-cheat-engine-on-roblox-2021-game-hack
    • http://katalog.iain-padangsidimpuan.ac.id/repository/coin-master-free-coins-link-blogspot_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/how-to-get-a-lot-of-robux_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/coin-master-gold-cards-hack-english_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/why-does-it-say-roblox-hacks-are-virus_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/earn-robux-for-roblox_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/how-too-hack-roblox-carlos-amin-house_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/coin-master-hack-apk-april-12-2021_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-free-glasses_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-hack-legend-speed_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-help-free-robux_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/how-to-get-free-robux-and-tix-no-hack_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-hack-2021_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/zyrus-roblox-hack_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-strucid-aimbot-hack-2021-august_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/hack-coin-master-mod-apk_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/earn-free-robux_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-black-clover-online-cheat_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-bee-swarm-simulator-honey-hack_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/coin-master-free-500-spins-link_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/cheats-for-roblox-jailbreack_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003403.bin
0d914965cf4ffcbcb86625a3cf02efda797d5821f54241f14670050d1fbf1366		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3403 22200 bytes
font_01_sfnt_off0000657b.bin
9c01ea1a6d902317ce623d308d0b73bd3082998c5be9723d5de781659fb0ec44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x657B 19800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.