Malicious PDF — malware analysis report

Static analysis result for SHA-256 63fef3b5e29ea762…

MALICIOUS

PDF

33.9 KB Created: 2021-07-03 17:17:33 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: acef05cf708195bf3d9b881c0466beb1 SHA-1: 03af2a67f9da148cdfdc6de257a46be2096fab9a SHA-256: 63fef3b5e29ea76247485aceffadf8693cbf4cf0a0dda15c2d5bfa00fd091901
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded URLs, many of which are structured as SEO link farms, pointing to pages offering game hacks and cheats. The ML classifier strongly flagged this PDF as malicious, and the presence of external links suggests an attempt to redirect users to malicious content or download sites. The document body, though partially garbled, contains references to these lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/free-minecraft-survival-server-game-hack PDF link annotation
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-get-free-roebucks_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/the-conquerors-3-roblox-hack_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-get-free-robux-without-downloading-apps-2021_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/roblox-hack-version-unlimited-robux_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/free-money-hack-roblox_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/free-coins-and-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-get-free-robux-easy-zephplayz_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/free-robux-just-click_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/roblox-adopt-me-cheats_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-get-all-catalog-free-roblox_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-get-free-robux-2021-feb_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/jai-recu-mess-me-i-hack-your-place-on-roblox_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/build-and-survive-sunbeam-free-roblox_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/free-robloxs-code_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/roblox-hack-com_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/minecraft-redeem-code-free-2021_GM479516143.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-hack-roblox-accounts-for-robux_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-get-a-free-valk-on-roblox_GM431946152.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-get-free-gold-cards-on-coin-master_GM406889139.pdfIn PDF document text
    • http://pustakasma.nurulfikri.sch.id/repository/how-to-hack-knives-in-assassin-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002eef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EEF 23084 bytes
SHA-256: 6383d2a25a4a85a99cb70c9288d651ca25473fa84971ca68c891181ce28e768a
font_01_sfnt_off00006227.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6227 18184 bytes
SHA-256: aa4b263e48621cfecba3d9fc0f6d5ba7bc8503c5f36487cc72bd4c38d51a6610

Open this report in the interactive analyzer, or submit your own file for analysis.