Malicious PDF — malware analysis report

Static analysis result for SHA-256 6596218975c0dc1d…

MALICIOUS

PDF

34.6 KB Created: 2021-07-06 06:49:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 6f5ff2f9db822dea19438c0424044c67 SHA-1: 966ae623e283c604fabb1c22b05d6940dab02f45 SHA-256: 6596218975c0dc1dd8685e79036e53a5c9e1187ec7a1dd90e6238ccba0165b10
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to external resources, many of which are hosted on a domain associated with 'earnrobux' and 'coin master' hacks. The document body and extracted URLs suggest a phishing attempt to trick users into downloading malicious files by promising in-game currency or cheats. The ML classifier and PDF link farm heuristics strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/earnrobux-game-hack
    • http://lib.teknik.unimal.ac.id//repository/robux-com-roblox_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id//repository/master-coin-hack-mod_GM406889139.pdf
    • http://lib.teknik.unimal.ac.id/repository/hack-pac-man-roblox_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/how-to-hack-free-robux-easy_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/coin-master-mod-apk-free-download_GM406889139.pdf
    • http://lib.teknik.unimal.ac.id/repository/coin-master-free-coins-and-spins-link-today_GM406889139.pdf
    • http://lib.teknik.unimal.ac.id//repository/coin-master-free-link-spin_GM406889139.pdf
    • http://lib.teknik.unimal.ac.id/repository/how-to-hack-roblox-2021-march_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/free-robux-instantly_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/free-spin-app-coin-master_GM406889139.pdf
    • http://lib.teknik.unimal.ac.id//repository/how-to-get-roblox-premium-for-free-2021_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id//repository/robux-generator-no-human-verification-2021_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/free-roblox-toy-codes-unused-2021-october-6_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id//repository/coin-master-daily-free-spins-link-app-download_GM406889139.pdf
    • http://lib.teknik.unimal.ac.id/repository/basic-roblox-lua-programming-pdf-free_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/free-robux-no-human-verification-or-survey-2021-on-android_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/how-to-hack-roblox-2021_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/free-hacks-cheats-and-bots-roblox_GM431946152.pdf
    • http://lib.teknik.unimal.ac.id/repository/coin-master-heaven-links_GM406889139.pdf
    • http://lib.teknik.unimal.ac.id/repository/coin-master-official-website_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000310f.bin
4d992e7c51c3be5e1d32e1135d0d17d68376bd9f45ee6e83b285e83fe5b8b557		 pdf-font-stream PDF embedded font (sfnt) at offset 0x310F 22624 bytes
font_01_sfnt_off00006391.bin
6794fc7ee49cdd0a33f98bbbc8a763353555002210e507bd98e2a39f67d6f290		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6391 18552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.