Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fb81b1e95ac49aa…

MALICIOUS

PDF

48.6 KB Created: 2021-05-14 02:08:21 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 2cead100a55ac53e6050be5fa632b09d SHA-1: b355923b97bd7c7d4f2834918a920293fa5fcef9 SHA-256: 5fb81b1e95ac49aa763d161f6971cfe9c68661d77448b73bf977fa2e3e6c2784
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of external links, many of which point to other PDF files hosted on the same domain, suggesting a link farm or SEO manipulation tactic. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the heuristic firings indicate a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9013

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/can-you-actually-get-free-robux-game-hack
    • http://www.alsultantrading.ae/userfiles/files/coin-master-free-spin-daily-link_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/como-hackear-coin-master-2021_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/coin-master-download-hack_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/coin-master-free-spins-link-2021-blogger_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/coin-master-free-spins-hack-link_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/how-to-get-free-robux-easy_GM431946152.pdf
    • http://www.alsultantrading.ae/userfiles/files/free-attacks-on-coin-master_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/how-to-hack-roblox-accounts_GM431946152.pdf
    • http://www.alsultantrading.ae/userfiles/files/legitimate-coin-master-free-spins-apk_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/free-minecraft-hacks_GM479516143.pdf
    • http://www.alsultantrading.ae/userfiles/files/how-to-get-free-premium-roblox_GM431946152.pdf
    • http://www.alsultantrading.ae/userfiles/files/tiktok-minecraft-hacks_GM479516143.pdf
    • http://www.alsultantrading.ae/userfiles/files/best-way-to-get-free-robux_GM431946152.pdf
    • http://www.alsultantrading.ae/userfiles/files/martian-lettuce-coin-master-free_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/coin-master-daily-free-coins-link_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/how-to-get-free-spins-on-coin-master-blogspot_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/coin-master-free-spins-and-coins-app-download_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/coin-master-free-spins-through-coin-pop_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/coin-master-codes_GM406889139.pdf
    • http://www.alsultantrading.ae/userfiles/files/get-robux-for-free-2021_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004cc4.bin
ee27a987d22fbb669dcccd231d245ff4b4f6875ca08bd23755a1fabfe9feab5c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4CC4 28264 bytes
font_01_sfnt_off00008d1b.bin
450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D1B 5696 bytes
font_02_sfnt_off00009a2c.bin
47da03a4981b0a54a8018003304e59ec7e3f87382350c48cbaac3b3d81608ccf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A2C 18764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.