Malicious PDF — malware analysis report

Static analysis result for SHA-256 657484df125cc0e5…

MALICIOUS

PDF

51.3 KB Created: 2021-06-03 07:54:28 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 92674e92d2ff30b1e3efa23dc4264c36 SHA-1: 4db74df3f600198bb09fdaf6e1173f4cbe7f0112 SHA-256: 657484df125cc0e5d5d6136f840af1c4dc095f0fa65163e2eee615b5b1cff407
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs that redirect to websites promising 'free Robux' or game hacks, acting as a lure for users. The ML classifier and specific PDF heuristics confirm the malicious nature of these links. While no scripts were explicitly extracted, the nature of the lures and embedded URLs suggests an intent to redirect users to potentially malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9724

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/free-robux-no-verify-game-hack PDF link annotation
    • http://gornjastubica.hr/files/free-robux-2021_GM431946152.pdfIn PDF document text
    • http://gornjastubica.hr/files/how-to-hack-people-on-roblox_GM431946152.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/free-robux-safe_GM431946152.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/free-robux-real-2021_GM431946152.pdfIn PDF document text
    • http://gornjastubica.hr/files/how-to-get-free-robux-no-scam_GM431946152.pdfIn PDF document text
    • http://gornjastubica.hr/files/coin-master-fb-free-spins-link_GM406889139.pdfIn PDF document text
    • http://gornjastubica.hr/files/minecraft-apk-free-download-016-0_GM479516143.pdfIn PDF document text
    • http://gornjastubica.hr/files/coin-master-unlimited-free-spins-link-2021_GM406889139.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/moonactive-free-spins-link_GM406889139.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/how-to-get-free-coins-in-minecraft_GM479516143.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/how-to-get-free-skins-in-roblox_GM431946152.pdfIn PDF document text
    • http://gornjastubica.hr/files/roblox-hack-com_GM431946152.pdfIn PDF document text
    • http://gornjastubica.hr/files/free-robux-no-verification-at-all_GM431946152.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/free-spin-link-for-coin-master-game_GM406889139.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/how-do-i-get-robux_GM431946152.pdfIn PDF document text
    • http://gornjastubica.hr/files/is-minecraft-bedrock-edition-free_GM479516143.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/links-to-get-free-coins-in-coin-master_GM406889139.pdfIn PDF document text
    • https://www.gornjastubica.hr/files/minecraft-java-free_GM479516143.pdfIn PDF document text
    • http://gornjastubica.hr/files/coin-master-free-spins-1-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005050.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5050 25008 bytes
SHA-256: e299f35d46a2cb0cb9b56f0e69c8ef874c83dc0466a491a212dc267e5451535b
font_01_sfnt_off00008a6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A6D 8252 bytes
SHA-256: 7ebedd6b182173c8e55836cb0d114b2c4a0ac85c96a51b9f0706c935f8415fea
font_02_sfnt_off0000a582.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA582 18448 bytes
SHA-256: c82a2e535d1b02ce633786be567827726fc21df48f71ae9cb05a1d9866072f5e

Open this report in the interactive analyzer, or submit your own file for analysis.