Malicious PDF — malware analysis report

Static analysis result for SHA-256 76b0b2f3b5a795be…

MALICIOUS

PDF

32.8 KB Created: 2021-07-04 06:35:15 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: e117294e5a3a9d3c86465fc11c5543d5 SHA-1: 8891f4a380543f490ab228c7c42762bd59c8c167 SHA-256: 76b0b2f3b5a795beb2070e48c2aecff672f399404f3e3eb846ae68a6bd41bb65
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links, many of which point to websites offering game hacks and cheats. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, suggesting a link farm or SEO abuse tactic. The ML classifier also flagged this PDF as malicious with high confidence. The document's content and structure strongly suggest it is designed to lead users to download potentially harmful files or visit malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/479516143/classic-minecraft-net-hacks-game-hack
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/free-robux-live_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/how-do-i-get-free-robux_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/2021-hack-roblox_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/roblox-prison-life-noclip-hack-2021_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/minecraft-hacked-apk_GM479516143.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/xray-for-roblox-for-hacks_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/coin-master-hack-for-ios_GM406889139.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/how-to-download-minecraft-for-free-on-pc_GM479516143.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/how-to-make-items-free-in-roblox_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/free-robux-today_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/hack-coin-master-8-ball-pool_GM406889139.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/roblox-games-free-download-for-android_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-on-pc_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/how-to-hack-on-roblox-mac_GM431946152.pdf
    • https://elearning.min11blitar.sch.id/__statics/gudangsoal/files/unlimited-robux-hack-no-human-verification_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/coin-master-daily-free-spins-link-today_GM406889139.pdf
    • https://elearning.min11blitar.sch.id/__statics/gudangsoal/files/dead-by-roblox-bloodpoints-hack_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/free-t-shirt-roblox_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/roblox-comcom_GM431946152.pdf
    • http://elearning.min11blitar.sch.id/__statics/gudangsoal/files/how-to-hack-coin-master-with-lucky-patcher_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f80.bin
2cc519ddcdbc1f80e441293ac03f97ff1216eefe1a07612c81122e407eee4240		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F80 21460 bytes
font_01_sfnt_off00005dfe.bin
e5e43c4f2a76601b68ea8201b0c37883eedd9e77f9c7f84ae37ad33981ff38f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DFE 18100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.