Malicious PDF — malware analysis report

Static analysis result for SHA-256 738ba49de85fc6d3…

MALICIOUS

PDF

44.2 KB Created: 2021-06-14 00:55:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 173e5a38b8f1e5e30f9b6b59f54ad148 SHA-1: eb9cb100a503c9ba402a815b168b4a9781c4acd1 SHA-256: 738ba49de85fc6d35b82acc2d6c1fe7c6472a76659631b3d083ab344e8b0eb72
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a document body that advertises free in-game items and hacks for popular games, aiming to trick users into clicking malicious links. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, many of which are likely part of a link farm designed to attract traffic. The ML classifier strongly suggests malicious intent, likely to lead users to download malware or engage in phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-freebies-robux-roblox-hack-game-hack PDF link annotation
    • https://library.uigm.ac.id/repository/free-spin-coin-master-today_GM406889139.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/how-to-get-minecraft-windows-10-for-free-with-java_GM479516143.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/http-blackgamesus-coinmasterhack_GM406889139.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/robux-now_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/roblox-premium-free_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/get-free-spins-in-coin-master_GM406889139.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/free-spins-coins-coin-master_GM406889139.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/do-you-get-minecraft-windows-10-for-free_GM479516143.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/roblox-group-free-robux_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/free-robux-with-no-survey_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/free-robux-place_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/roblox-vehicler-simulator-afk-money-hack_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/minecraft-free-minecoins_GM479516143.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/download-to-free-admin-in-roblox_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/get-free-lives-on-coin-master_GM406889139.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/youtube-how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/how-to-get-free-robux-easy-hack_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/can-you-make-a-minecraft-server-for-free_GM479516143.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/is-hacking-illegal-in-roblox_GM431946152.pdfIn PDF document text
    • https://library.uigm.ac.id/repository/getrobux-info_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000499c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x499C 27812 bytes
SHA-256: c15af9179e3c24fcf943b46d001a0ca80466b42d9c193af520bd72077e0ba8f1
font_01_sfnt_off000089b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x89B7 18604 bytes
SHA-256: 28e1c940bacea1215ca2c3e53c24e0f8ade4d93c78c47c76f0c33ef82878a3ed

Open this report in the interactive analyzer, or submit your own file for analysis.