Malicious PDF — malware analysis report

Static analysis result for SHA-256 57e90e36ba910b3a…

MALICIOUS

PDF

35.4 KB Created: 2021-06-27 19:32:03 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: b31c97929c96c7ee56f3a6e231dfd01b SHA-1: f03448f51a16c08a2beb10139c18717a28e75be2 SHA-256: 57e90e36ba910b3a934a73feb99feb7116587295d874e6cd6e3b1f703f70eec5
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a "link farm" structure, strongly suggesting it is designed to redirect users to malicious websites. The document body and extracted URLs explicitly mention "Free Robux" and "hacks," indicating a common lure for phishing or malware distribution. While no scripts were directly extracted, the PDF structure and extensive URL embedding are indicative of malicious intent, likely to download a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-robux-for-tablet-pro-game-hack
    • http://sdn4-wates.sch.id/akasia/repository/object-demonius-free-roblox_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/how-to-get-free-robux-by-playing-roblox-games_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/complete-offers-for-robux_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/btools-roblox-hack-2021_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/how-to-get-roblox-premium-for-free_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/free-spin-coin-master-new-link_GM406889139.pdf
    • http://sdn4-wates.sch.id/akasia/repository/free-roblox-girls-outfit-codes_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/free-gear-roblox-script-pastebin_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/daily-free-spins_GM406889139.pdf
    • http://sdn4-wates.sch.id/akasia/repository/how-to-get-free-roblox-money_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/free-robux-scam-place-download_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/seven-v2-roblox-free-download-2021_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/free-roblox-dont-need-any-robux_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/fly-hack-for-strucid-roblox_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/roblox-shirt-free-edit-avatar_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/ways-to-get-free-robux_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/roblox-hacks-through-walls-on-jailbreak_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/minecraft-name-tag-hacks_GM479516143.pdf
    • http://sdn4-wates.sch.id/akasia/repository/free-robux-legit_GM431946152.pdf
    • http://sdn4-wates.sch.id/akasia/repository/les-commandes-dadmin-roblox-les-plus-cheat_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031dc.bin
263e933958860b09844376635496939aac783eda761ad9b1056792565e1d5b72		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31DC 22944 bytes
font_01_sfnt_off00006593.bin
5ef8b1246f061c805e27683794806f8bfef9c58dc6373cbb83ac4ada744f9146		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6593 19048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.