Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a81a77338d9be80…

MALICIOUS

PDF

50.7 KB Created: 2021-06-10 22:30:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6f6e73ceba392e7fe88e79416f86c26d SHA-1: 59e9bffdc498e7d92c4645f76c2ace521997962a SHA-256: 5a81a77338d9be80bc367e588ee9d8e3c1f64a0068c62856c5faee3526948ea0
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs that lead to link farms, suggesting a deceptive attempt to drive traffic to potentially malicious sites. The document body and extracted URLs indicate a lure related to free game items, a common social engineering tactic. While no scripts were explicitly extracted, the PDF structure and heuristic firings suggest it may contain embedded JavaScript or other mechanisms to facilitate the redirection and download of further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9871

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-sound-code-roblox-game-hack PDF link annotation
    • http://repository.ummy.ac.id/repository/download-free-download-how-to-buy-free-robux_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/coin-master-free-spin-link-app_GM406889139.pdfIn PDF document text
    • http://repository.ummy.ac.id/repository/how-do-you-buy-robux-for-free_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/pokemon-go-free-qr-code_GM1094591345.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/free-roblox-money_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/vip-roblox-free_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/coin-master-free-spins-link-may-2021_GM406889139.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/robux-get-com_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/roblox-pink-free-robux_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/how-to-become-a-hacker-in-roblox_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/how-do-i-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/free-roblox-characters_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/minecraft-114-download_GM479516143.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/www-roblox-com-robux-free_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/tower-of-hell-roblox-hack_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/coin-master-free-spins-link-whatsapp-group_GM406889139.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/free-daily-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/coin-master-apk-free-download_GM406889139.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/free-robux-no-verification-or-survey-2021_GM431946152.pdfIn PDF document text
    • http://repository.ummy.ac.id//repository/free-robux-no-verification-no-survey_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000051af.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x51AF 36968 bytes
SHA-256: 5915fad20c54c82090c054f4be93e0276d36d697c401c0cc80c64fc3e685b3d1
font_01_sfnt_off0000a406.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA406 18260 bytes
SHA-256: 2cf3ab18e0dfa0da8f2d54ee077bf0797d1a0e8030fc9be1f345712246a02650

Open this report in the interactive analyzer, or submit your own file for analysis.