Malicious PDF — malware analysis report

Static analysis result for SHA-256 57ba2dac640b3cc1…

MALICIOUS

PDF

35.1 KB Created: 2021-07-09 04:32:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 9aae147f476db58e9f81a9b37fbac49f SHA-1: e45e8ec04f73b626293ebf59973f31e990b29049 SHA-256: 57ba2dac640b3cc1e3b8c83de67ac92ae94b0433b1d17f66864fb453374524fc
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are structured as SEO-optimized PDF links pointing to game-related hacks and cheats. The ML classifier strongly flagged this PDF as malicious, and the presence of a download button lure further supports a malicious intent to redirect users to potentially harmful content. The primary attack pattern involves tricking users into clicking malicious links that likely lead to malware downloads or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/anime-roblox-roblox-face-free-game-hack PDF link annotation
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-no-verification-no-password_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-hack-roblox-accounts-for-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-free-spins-cash_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-coin-master-glitches_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/all-66-free-items-roblox_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-get-free-unlimited-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-hack-no-human-verification-no-download_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-modded-minecraft-server-hosting_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-free-5-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-hack-no-human-verification_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-apk-mod-free-download_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-army-free-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-hack-pokes-roblox-account_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-glitches-2021_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/pokemon-go-free-pokecoins-no-human-verification_GM1094591345.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/hacking-game-roblox_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/rblx-city-free-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/haktuts-2021-coin-master-free-spin-link_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-websites-that-work_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000330e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x330E 22344 bytes
SHA-256: e6e83d0af42cde8d7c62a32598b5e76515364119922bbe86202c78d0f85a0346
font_01_sfnt_off000064f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64F2 18844 bytes
SHA-256: 34838660bfb0ce11bd5251d19e6418dc618c6c4ae08487745f4e8473e10503b1

Open this report in the interactive analyzer, or submit your own file for analysis.