Malicious PDF — malware analysis report

Static analysis result for SHA-256 5557d758c95e3646…

MALICIOUS

PDF

34.5 KB Created: 2021-07-05 16:59:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 676a4cdb62f54ff242d8507c0389bdd9 SHA-1: d7cf9cc710b8871111061e124e205b6ff841bbd9 SHA-256: 5557d758c95e36468a202f7ea2d1f021c31754bb29025e01f340dbda5a60536a
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains numerous links to external websites, many of which are related to game hacks and exploits for popular games like Roblox and Pokemon Go. The presence of a 'Download Now' lure and the ML classifier's high confidence score indicate a malicious intent to redirect users to potentially harmful content or initiate downloads. The document's structure suggests it is part of a link farm designed to attract users searching for cheats and hacks.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/robux-scam-game-hack
    • http://library.itekes-bali.ac.id/repository/roblox-pokemon-brick-bronze-shiny-hack_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/veorra-set-free-roblox-id_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/free-stuff-on-roblox-mobile_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/roblox-free-hair-girl_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/how-to-use-cheat-engine-with-roblox_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/how-to-get-free-pokeballs-in-pokemon-go_GM1094591345.pdf
    • http://library.itekes-bali.ac.id/repository/how-do-i-hack-a-roblox-account_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/how-to-hack-any-roblox-account_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/bloxxer-free-robux_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/blogspot-coin-master-free-spins_GM406889139.pdf
    • http://library.itekes-bali.ac.id/repository/inject-hack-com-roblox-hack-injector_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/hack-mining-simulator-roblox-2021_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/free-robux-that-actually-works-2021_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/free-sdcript-executer-for-roblox_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/roblox-phantom-forces-level-hack_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/free-doge-head-roblox_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/bhop-roblox-hack_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/inspect-element-free-robux_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/how-to-get-unlimited-robux-on-roblox-with-cheat-engine_GM431946152.pdf
    • http://library.itekes-bali.ac.id/repository/how-to-get-free-stuff-roblox-ipad_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000307a.bin
f611d26ce91a0a2106c15a706d9c5f4889553a3e55f57b0a74e540a43f329963		 pdf-font-stream PDF embedded font (sfnt) at offset 0x307A 22408 bytes
font_01_sfnt_off000062a9.bin
4ffaf6f842fcb0c6b0921ba835fae5c2fe515a7d00dacf83ff08996cba6db885		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62A9 18812 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.