Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c2bac0076324df0…

MALICIOUS

PDF

35.0 KB Created: 2021-06-27 19:59:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 495b5c33155f14a72b29404e10a58dc9 SHA-1: d157fc50d7704e3e15636ca0d9b0b8dacc2f9044 SHA-256: 5c2bac0076324df02fe47059aa86c9e1c088f2730b13a72aacd8e62de275a0e1
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links, forming a link farm, that direct users to websites promising free in-game currency and hacks. The heuristic 'PDF_SEO_LINK_FARM' and the presence of multiple suspicious URLs indicate a social engineering attempt to drive traffic to potentially malicious sites. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-get-free-roubox-in-roblox-game-hack
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-hack-xyz_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/free-robux-if-u-join-this-group_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/free-faces-roblox-catolog_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-free-spins-2021_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-get-minecraft-windows-10-for-free-2021_GM479516143.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/robux-generator-no-human-verification-or-survey_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-gold-cards-hack_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-free-spins-generator_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-hack-coin-master-game-without-verification_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/app-store-coin-master-free-spins_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-many-levels-are-there-in-coin-master_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-get-free-robux-without-human-verification-on-iphone_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-get-free-robux-without-downloading-apps_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/free-coins-and-spins-for-coin-master_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/minecraft-server-free-trial_GM479516143.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-generate-free-coin-master-spin_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/minecraft-bedrock-hacks-windows-10_GM479516143.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/coin-master-pc-hack-download_GM406889139.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-buy-robux-for-free_GM431946152.pdf
    • http://dev.pmrscambodia.org/images/uploadfiles/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003295.bin
f5b91e5f63dd31ee4668f282b743b5e8a46d169dbede03093083c65bddc4622e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3295 22204 bytes
font_01_sfnt_off000063b0.bin
342c8f4d4505567a4d6bb64c9d207a0f5476c4e67e7c0cfd8bd45c91d5c3f8f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63B0 19056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.