Malicious PDF — malware analysis report

Static analysis result for SHA-256 712e60d51c7069fc…

MALICIOUS

PDF

48.0 KB Created: 2021-05-17 16:31:18 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 05235bfebc211be057a562f369e449c1 SHA-1: 75b88c6751c0687d220ddf016b23095070f79060 SHA-256: 712e60d51c7069fc1a7c0320f00483e3f5e59b902f36a020757c23953c30b0eb
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file contains numerous links to other PDF files, many of which are hosted on the same domains and appear to be lures for game hacks and free items. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm or SEO abuse for malicious purposes. The ML classifier also flagged this PDF as malicious with high confidence. The document's content and structure strongly indicate it is part of a phishing or scam campaign designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9013

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-free-items-2021-game-hack
    • http://www.6636.com.tw/ad6636/upload/files/hacked-roblox-game_GM431946152.pdf
    • http://www.6636.com.tw/ad6636/upload/files/coin-master-hack-app-android_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/how-to-get-free-robux-inspect_GM431946152.pdf
    • http://www.6636.com.tw/ad6636/upload/files/how-to-get-free-robux-on-chromebook_GM431946152.pdf
    • http://www.6636.com.tw/ad6636/upload/files/how-to-get-free-robux-promo-codes_GM431946152.pdf
    • http://www.6636.com.tw/ad6636/upload/files/coin-master-coin-hack_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/rewardrobux-com_GM431946152.pdf
    • http://www.6636.com.tw/ad6636/upload/files/free-spins-coin-master-october-13-2021_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/pixies-gigantic-coin-master-free-spins-and-coins_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/free-spins-for-coin-master-2021_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/coin-master-hack-tool-v1-9-download_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/op-rewards-free-robux_GM431946152.pdf
    • http://www.6636.com.tw/ad6636/upload/files/coin-master-free-chest-link_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/coin-master-free-link-blogspot_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/coin-master-hack-using-cheat-engine_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/roblox-robux-hack-generator_GM431946152.pdf
    • http://www.6636.com.tw/ad6636/upload/files/coin-master-free-spins-cheat_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/free-coin-master-spins-2021_GM406889139.pdf
    • http://www.6636.com.tw/ad6636/upload/files/claim-gg-free-robux_GM431946152.pdf
    • http://www.6636.com.tw/ad6636/upload/files/free-spins-coin-master-facebook_GM406889139.pdf
    • https://rblx.land
    • https://www.roblox.com
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a63.bin
8801116de5eeff78b394cceab5367d4d596df019a6a9eebd10209ab6ba09ce4d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A63 28784 bytes
font_01_sfnt_off00008b21.bin
5ef1e19c69d8e99c7deac9d0824491ec3447569bccddd9edde4bc96b699984a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B21 3680 bytes
font_02_sfnt_off000097e8.bin
1ac7dfea826aa1cf6bdd8a8871d75981f44760a1c5f47be9d1d913bfc788d2a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x97E8 18716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.