Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ab3b70d85f549a6…

MALICIOUS

PDF

36.7 KB Created: 2021-06-22 12:34:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: ff03afc4a622b790c83a0e5f21e0e62d SHA-1: 1ee7f5fc4e55a9436001158bde588ec9284fe867 SHA-256: 5ab3b70d85f549a669e2b9e426dad05574f7eb108c24fa2868208660150ecfa2
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded links, many of which point to other PDF documents with titles suggesting game hacks or cheats. The primary URL, http://netcdn.co/app/406889139/how-to-get-free-spins-in-coin-master-game-hack, is likely a lure to download a malicious payload. The ML classifier strongly indicated maliciousness, and the presence of a link farm heuristic further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/406889139/how-to-get-free-spins-in-coin-master-game-hack PDF link annotation
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/boku-no-roblox-hack_GM431946152.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/get-free-tiktok-fans_GM835599320.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/coin-master-free-spin-and-coins-links-home_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/rbx-free-robux_GM431946152.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/how-to-hack-into-your-old-roblox-account_GM431946152.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/roblox-hack-fly-2021_GM431946152.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/free-spins-and-coins-blogspot-coin-master_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/coin-master-free-coins-and-spins_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/google-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/free-robux-offers_GM431946152.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/coin-master-free-spins-today-daily-links_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/free-robux-on-phone_GM431946152.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/minecraft-noob-vs-pro-vs-hacker_GM479516143.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/how-to-download-minecraft-for-free-ios_GM479516143.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/haktuts-coin-master-free-daily-spins_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/coin-master-hack-for-android_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/free-spin-link-for-coin-master-game_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/how-to-get-free-coins-on-flip-master_GM406889139.pdfIn PDF document text
    • https://www.christchurch-burton.staffs.sch.uk/admin/ckfinder/userfiles/files/free-spins-and-coins-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003867.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3867 23240 bytes
SHA-256: 6a670386b08a64820c64f2f08c8f76ff076c936fd281ca4076ffd1f30b59fbc5
font_01_sfnt_off00006cd8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6CD8 18336 bytes
SHA-256: 11de4304e4fdf887d410d1e4a25cee46ae29c04a9263dbbe12b650d8207992b4

Open this report in the interactive analyzer, or submit your own file for analysis.