Malicious PDF — malware analysis report

Static analysis result for SHA-256 758e10856a5dae3e…

MALICIOUS

PDF

47.2 KB Created: 2021-05-15 13:31:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 596d27b921d614efdd3d41b53fdd535e SHA-1: f68a3e1b6a2f535620a19aa7e7a373e20162e42b SHA-256: 758e10856a5dae3efdd0d333c06fdf51bf3e1b2f55939e70b15c1e23ab264f3a
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which are SEO-optimized and point to potentially malicious content related to game hacks and free spins. The presence of a 'download button' heuristic further suggests a deceptive user interaction. While no scripts were explicitly extracted, the PDF structure and numerous embedded URLs indicate an attempt to redirect users to malicious sites, likely for malware distribution or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8948

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-com-free-robux-game-hack
    • http://lib.pps.uin-suka.ac.id/repository/coin-master-free-spin-today_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/get-coin-master-spins-free_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/coin-master-hack-app_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/minecraft-pe-hacks-ios_GM479516143.pdf
    • http://lib.pps.uin-suka.ac.id/repository/free-cracked-minecraft-server-hosting_GM479516143.pdf
    • http://lib.pps.uin-suka.ac.id/repository/free-coin-master-spins-daily_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/coin-master-hack-activegamer_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/coin-master-gold-cards-free-link_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/coin-master-free-spins-link-facebook_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/windows-10-minecraft-free-with-java_GM479516143.pdf
    • http://lib.pps.uin-suka.ac.id/repository/get-free-spins-coin-master_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/minecraft-skins-download-free_GM479516143.pdf
    • http://lib.pps.uin-suka.ac.id/repository/hack-coin-master-free_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/2021-free-spins-coin-master_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/bit-ly-coin-master-hack_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/free-spins-on-coin-master_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/coin-master-free-cards-2021_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/coin-master-hack-tool-no-human-verification_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/coin-master-free-coins-and-spins-today_GM406889139.pdf
    • http://lib.pps.uin-suka.ac.id/repository/free-coin-master-spins-hack_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c3f.bin
73611f386e070250afdcd7b90841eaf0c7b132e8e79916cbe2c4cd7d3260ccdf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C3F 25932 bytes
font_01_sfnt_off0000892a.bin
450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139		 pdf-font-stream PDF embedded font (sfnt) at offset 0x892A 5696 bytes
font_02_sfnt_off0000963c.bin
c296ce3e2e2a101d3e2a91d968c24b195b6c9a3a72cf9c6f74fe8dc429b2d5e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x963C 18348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.