Malicious PDF — malware analysis report

Static analysis result for SHA-256 7779626ad419efb8…

MALICIOUS

PDF

48.4 KB Created: 2021-06-07 16:51:27 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 3e871568c34acf1a0f8f76c714ea013e SHA-1: 229af351fdd3a4349c896a24a7500fc6b43be14c SHA-256: 7779626ad419efb87c7f008e86366d0002b8f2325e2dbb27de609f1b03702280
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to external websites, many of which are structured as SEO-optimized PDF links, suggesting a link farm. One prominent URL, https://netcdn.tw/app/431946152/roblox-free-op-scripts-game-hack, is directly associated with the document's theme of game cheats. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded links and the overall structure strongly indicate a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-free-op-scripts-game-hack
    • http://neltalen.nl/images/how-to-download-minecraft-for-free-on-iphone_GM479516143.pdf
    • http://neltalen.nl/images/minecraft-apk-download-v1-144-2-free_GM479516143.pdf
    • http://neltalen.nl/images/free-robux-no-human-verification-or-survey-2021_GM431946152.pdf
    • http://neltalen.nl/images/free-robux-hack-no-verification_GM431946152.pdf
    • http://neltalen.nl/images/coin-master-hack-app-link_GM406889139.pdf
    • http://neltalen.nl/images/how-to-hack-into-someones-roblox-account_GM431946152.pdf
    • http://neltalen.nl/images/how-to-get-free-robux-for-kids_GM431946152.pdf
    • http://neltalen.nl/images/free-robux-ad_GM431946152.pdf
    • http://neltalen.nl/images/how-to-get-free-robux-no-scam_GM431946152.pdf
    • http://neltalen.nl/images/hack-coin-master-download-ios_GM406889139.pdf
    • http://neltalen.nl/images/minecraft-noob-vs-pro-vs-hacker_GM479516143.pdf
    • http://neltalen.nl/images/coin-master-free-spins-1-coin-master_GM406889139.pdf
    • http://neltalen.nl/images/how-to-get-minecraft-pe-for-free_GM479516143.pdf
    • http://neltalen.nl/images/androeed-ru-minecraft_GM479516143.pdf
    • http://neltalen.nl/images/minecraft-free-android_GM479516143.pdf
    • http://neltalen.nl/images/free-coin-master-spins-2021_GM406889139.pdf
    • http://neltalen.nl/images/roblox-hack-2021_GM431946152.pdf
    • http://neltalen.nl/images/coin-master-daily-free-spin-and-coin_GM406889139.pdf
    • http://neltalen.nl/images/free-robux-no-verification-2021_GM431946152.pdf
    • http://neltalen.nl/images/how-to-hack-people-in-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000050bc.bin
d13a581b27c03561246c7c8dbd972d522acb3a57c355cddf39cff995fd737f6d
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x50BC 26816 bytes
font_01_sfnt_off00008de5.bin
8e24205afdd13dcdea98f8150ef77dee4030e0e50a7c748783d1b4598e034a20
pdf-font-stream PDF embedded font (sfnt) at offset 0x8DE5 3464 bytes
font_02_sfnt_off00009a1b.bin
fa08b53bc5e3c57bb270990bb0987c0fac167920b684a3b2e88ea948987d789d
pdf-font-stream PDF embedded font (sfnt) at offset 0x9A1B 18348 bytes