Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b4ebf373556ae0b…

MALICIOUS

PDF

43.6 KB Created: 2021-05-17 23:02:52 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 46e0e8690e063c60f74ad47bd3c21143 SHA-1: a54860bc6add160ed0dda05b937e831077d334e0 SHA-256: 5b4ebf373556ae0b10b1f76043319f7651d0d87dab643f0cc6abca5d9333f55b
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document exhibits malicious characteristics, including a high ML classifier score and the presence of a fake CAPTCHA lure. It contains numerous external links, many pointing to PDF files with SEO-like titles related to game cheats and hacks, suggesting a link farm or redirection scheme. The primary URL, 'https://netcdn.xyz/app/431946152/how-to-get-free-robux-hack-2021-game-hack', likely serves as the initial entry point for this malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-get-free-robux-hack-2021-game-hack
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/free-diamonds-coin-master_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/how-to-get-free-daily-spins-on-coin-master_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/links-to-get-free-coins-in-coin-master_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/10-robux_GM431946152.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/coin-master-game-hacking_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/coin-master-free-spin-and-coins-fbid-links_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/coin-master-daily-free-cards_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/mcpe-master-coin-hack-apk_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/minecraft-hax-download-no-virus_GM479516143.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/a-lot-of-robux_GM431946152.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/free-spins-coin-master-hack-2021_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/how-to-hack-minecraft-pe_GM479516143.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/free-robux-generator-2021-no-human-verification_GM431946152.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/is-it-possible-to-get-free-robux_GM431946152.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/free-spin-coin-master-hacktoman_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/coin-master-free-spins-hack_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/coin-master-free-coins-facebook_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/rbxoffers-com-free-robux_GM431946152.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/moonactive-coin-master-free-spins_GM406889139.pdf
    • https://www.shopinkart.co.in/uploaded_files/userfiles/files/coin-master-spins-gratis_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004ba5.bin
0de55b087045a30b31122ad96fa79ea08a090d5559809b40345f52a16e4cad5a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4BA5 25084 bytes
font_01_sfnt_off0000856e.bin
bf126c80224e4ece1a877f3c45a4e2f725662c205f8b78a709aa4c80730d283c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x856E 19084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.