Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c9fd0114808a44e…

MALICIOUS

PDF

32.7 KB Created: 2021-04-04 03:03:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: 03ec1626d961ceb9d4744fc90dce8e73 SHA-1: 8672089b265ad5e96abfecc26f7896fa4c3f47cf SHA-256: 6c9fd0114808a44eb7f837a928443453fb39c3d071a1a499bd0b67cc70662c4f
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF document contains a large number of embedded URLs, identified as a link farm for game hacks and scams. The primary lure appears to be related to 'free Robux' or game cheats for popular titles like Roblox. The ML classifier strongly indicates maliciousness, and the heuristic firings confirm the presence of scam-related link farms. The document body consists almost entirely of these scam URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9725

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/free-roblox-account-dantdm PDF link annotation
    • http://www.vktzunami.cz/images/free-brighton-and-hove-buses-roblox.pdf%0AIn PDF document text
    • http://www.occquimica.com.br/images/how-to-noclip-in-roblox-jailbreak-cheat-engine.pdf%0AIn PDF document text
    • https://www.cosmosdawn.net/images/how-to-cheat-in-robux-2021.pdf%0AIn PDF document text
    • http://salantiskis.lt/images/pastebin-free-robux-no-waiting.pdf%0AIn PDF document text
    • http://pia2000.net/images/free-robux-2021-on-pc.pdf%0AIn PDF document text
    • http://ff-obertraun.at/images/how-to-get-flyable-pets-in-roblox-free.pdf%0AIn PDF document text
    • http://www.malonmalon.com.ar/images/free-robux-no-human-verification-2021-pc.pdf%0AIn PDF document text
    • http://www.sapaengineering.kz/images/robux-hack-robux-no-survey.pdf%0AIn PDF document text
    • http://www.occquimica.com.br/images/contrasea-de-roblox-hack-tool.pdf%0AIn PDF document text
    • http://www.zdravazena.sk/images/how-to-hack-giovannis-roblox-account.pdf%0AIn PDF document text
    • http://www.adravietnam.org/images/get-free-roblox-robux-on-therobuxapp-com.pdf%0AIn PDF document text
    • http://leigraphics.com/images/robux-hack-validation-code.pdf%0AIn PDF document text
    • http://texnes-plus.gr/images/how-to-download-roblox-hacks.pdf%0AIn PDF document text
    • https://luminouswisdom.org/images/free-roblox-redeem-codes-no-survey.pdf%0AIn PDF document text
    • http://www.exikom.com.ua/images/mario-64-roblox-rom-hack-code.pdf%0AIn PDF document text
    • https://www.stkdb.cz/images/dragon-simulator-roblox-hack.pdf%0AIn PDF document text
    • http://www.fluidtech.hu/images/roblox-console-robux-hack.pdf%0AIn PDF document text
    • https://www.cnte.org.br/images/how-to-download-hacks-in-roblox.pdf%0AIn PDF document text
    • https://consorziocsa-asicaivano.it/images/como-tener-cosas-gratis-en-roblox-hack.pdf%0AIn PDF document text
    • http://www.web.stc-part.co.th/images/roblox-free-codes-2021.pdf%0AIn PDF document text
    • https://www.academiaanticorrupcion.org/images/free-hacks-for-roblox-counter-blox.pdf%0AIn PDF document text
    • http://poltekkeskhjogja.ac.id/images/como-hackear-una-cuenta-de-roblox.pdf%0AIn PDF document text
    • http://axia-verlag.at/images/cheats-max-roblox.pdf%0AIn PDF document text
    • http://www.drent.se/images/roblox-hacks-to-get-in-people-acounts.pdf%0AIn PDF document text
    • http://www.copoint.co.uk/images/hack-slash-ghostemane-roblox-id.pdf%0AIn PDF document text
    • http://www.ntc.edu.za/images/mega-hack-roblox.pdf%0AIn PDF document text
    • http://baah.ca/images/hack-roblox-robux-download.pdf%0AIn PDF document text
    • https://www.foodsafety.cz/images/how-to-get-free-money-in-roblox-adopt-me-2021.pdf%0AIn PDF document text
    • https://www.dierenartsberghman.be/images/get-free-robux-without-human-verification-2021.pdf%0AIn PDF document text
    • http://www.sanjosedeminas.gob.ec/images/roblox-robot-simulator-hack.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off000033ef.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33EF 19020 bytes
SHA-256: 9ae5a70dd4494f4021c28f0c0c49f31c43ad7069e5fe8b6824d45ef07e7ed689
font_01_sfnt_off00005b66.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B66 18556 bytes
SHA-256: 196addb978cc1aa6d85b94df4988cc743c6d538426cba9c4a60820356d82577b