Malicious PDF — malware analysis report

Static analysis result for SHA-256 49616b3170b8c026…

MALICIOUS

PDF

47.4 KB Created: 2021-06-11 02:52:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 509c08c2db92e96051bb8d1c2583ee4b SHA-1: 176386006041a4015c1f020c61ab431dea7abd2c SHA-256: 49616b3170b8c026cfb139158b6d0f66eb1c78a4f826a10926ab04ecf82e5c6c
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document, generated by wkhtmltopdf, contains numerous external links disguised as guides for game cheats and exploits. The primary URL, https://netcdn.tw/app/431946152/how-to-walk-through-walls-in-roblox-cheat-engine-2021-game-hack, and a large farm of other PDF links suggest a malicious SEO or link-farming scheme. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted, but the document's structure and embedded links indicate an attempt to direct users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9832

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/how-to-walk-through-walls-in-roblox-cheat-engine-2021-game-hack PDF link annotation
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/free-spin-in-coin-master_GM406889139.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/free-spins-coins-coin-master_GM406889139.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/minecraft-realms-free-codes_GM479516143.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/how-you-get-free-robux_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/earn-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/does-john-doe-actually-hack-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-hack-john-doe-in-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/minecraft-dungeons-download-free_GM479516143.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/free-minecraft-alt-accounts_GM479516143.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/phlego-films-roblox-free-bsdge_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/como-ser-hacker-en-roblox-skywars_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/how-get-free-stuff-in-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-insert-scripts-on-roblox-with-cheat-engine_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/hacking-giving-my-fans-robux_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-get-free-roblox-legally_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-hack-people-in-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/free-tiktok-likes-and-followers_GM835599320.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/how-to-hack-a-roblox-account-easy_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/rbx-free-robux_GM431946152.pdfIn PDF document text
    • http://pustaka.antropologi.fisip.unand.ac.id/repository/minecraft-bedrock-server-hosting-free_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000535d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x535D 28096 bytes
SHA-256: 24f4db46e5ffcfab7c860ced0e8e4ef17dfa9d4babb28002a9e4f1ed0e7b1bee
font_01_sfnt_off0000924d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x924D 19764 bytes
SHA-256: 88afb6b2d3b3a3cd4f704efb2e3d89a82c97eca6921a40fd20a683aa6aece56f

Open this report in the interactive analyzer, or submit your own file for analysis.