Malicious PDF — malware analysis report

Static analysis result for SHA-256 7552e047e67fb2cc…

MALICIOUS

PDF

47.9 KB Created: 2021-06-03 08:32:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: e11be1632c431d9aa2c9ab60a8b2aa8b SHA-1: 72aad99e0984df9a457a241e3074ee19817301f1 SHA-256: 7552e047e67fb2cce7660df1e2e981ac6485900c2d91804e553ee373f940b691
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains numerous links to external websites, many of which are presented as game hacks or cheats for popular games like Coin Master and Roblox. The document's structure and content suggest a phishing or scam attempt to lure users into downloading potentially malicious software or visiting compromised sites. The presence of a large number of external links, identified as a link farm, further supports this malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/406889139/coin-master-hack-apk-2021-download-game-hack
    • http://katalog.iain-padangsidimpuan.ac.id/repository/free-roblox-com_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/more-robux_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/free-games-like-coin-master_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/free-online-spins-coin-master_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/get-gold-coin-master-village-hack_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/how-can-you-get-free-robux_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/coin-master-free-coins-and-spins-daily_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/where-to-get-free-robux_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-com-free-play_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/coin-master-spin-free_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/minecraft-pocket-edition-free-download_GM479516143.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/how-to-hack-to-get-robux_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/roblox-gift-card-online-free_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/how-to-get-free-outfits-on-roblox_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/coin-master-free-spins-and-coins-haktuts_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/can-you-earn-robux_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/coin-master-hack-mod-apk-download_GM406889139.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/how-to-hack-roblox-accounts-2021-easy_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/how-to-get-free-robux-no-human-verification_GM431946152.pdf
    • http://katalog.iain-padangsidimpuan.ac.id/repository/clients-minecraft_GM479516143.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005212.bin
d46a7b24c28e6afa30019adfd7441b8b369cf3b18d1f57e7c19836a43ece66cc		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5212 25488 bytes
font_01_sfnt_off00008cb7.bin
b053084cafd01c649462d87667ba56c569d6480ce60e7d20ae57ef6124cf178e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CB7 2880 bytes
font_02_sfnt_off000096a2.bin
be5be3eecf441f83945d2891df9f868a1d3a5dfc921b9d485f27c984001e53f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96A2 18876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.