Malicious PDF — malware analysis report

Static analysis result for SHA-256 78611dff4d5a6ab8…

MALICIOUS

PDF

47.0 KB Created: 2021-04-03 18:32:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 8e40b1658a97f2b2650363e036a44b23 SHA-1: c94433f1d91757bcab913abeb3462058ad439752 SHA-256: 78611dff4d5a6ab808e8c33708d38d0ea91fb08ce2719d8af4108a586058d929
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of links to websites promising game hacks and virtual currency, indicative of a scam or phishing operation. The heuristic 'PDF_GAME_HACK_SEO_LINK_FARM' strongly suggests this malicious intent. While no scripts were extracted, the document body and heuristics point to a spearphishing attachment used to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8097

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/mad-factor-mad-city-hack-roblox PDF link annotation
    • http://www.torvet11.dk/images/free-robux-script-2021.pdf%0AIn PDF document text
    • https://www.albisser.ch/images/hacker-shirt-roblox.pdf%0AIn PDF document text
    • https://www.air-shop.cz/images/free-robux-gift-card-20210-robux-codes-2021.pdf%0AIn PDF document text
    • https://www.milewood.co.uk/images/hacked-jailbreak-roblox-with-no-verification.pdf%0AIn PDF document text
    • http://escolaarboc.cat/images/free-robux-no-human-verification-or-survey-2021-easy.pdf%0AIn PDF document text
    • http://www.adravietnam.org/images/descendants-2-games-on-roblox-free.pdf%0AIn PDF document text
    • http://www.zdravazena.sk/images/apocalypse-rising-roblox-hacker-gives-best-loot.pdf%0AIn PDF document text
    • http://www.fluidtech.hu/images/free-robux-100-working-2021.pdf%0AIn PDF document text
    • http://www.gadanie.lv/images/hack-roblox-net-one-handynummer.pdf%0AIn PDF document text
    • https://www.iadh.bi/images/roblox-rainbow-wings-free.pdf%0AIn PDF document text
    • http://bkd1.balikpapan.go.id/images/counter-blox-roblox-offensive-hack-free.pdf%0AIn PDF document text
    • http://www.boic.nl/images/free-robux-now-no-survey.pdf%0AIn PDF document text
    • http://echosvoix.ch/images/free-roblox-redeem-card-codes-2021.pdf%0AIn PDF document text
    • https://www.sitiwebjoomla.it/images/goo-gl-wx0ofq-free-robux.pdf%0AIn PDF document text
    • http://www.lovecraftiana.com.ar/images/free-roblox-accounts-with-lifetime-obc.pdf%0AIn PDF document text
    • http://escolaarboc.cat/images/roblox-studio-free-scripts.pdf%0AIn PDF document text
    • https://kimolos-link.gr/images/how-to-get-free-robux-ipad-only-2021-youtube.pdf%0AIn PDF document text
    • https://gomsa.nl/images/hack-para-roblox-dragon-ball-rage.pdf%0AIn PDF document text
    • http://svp-steinmaur.ch/images/free-bugatti-roblox.pdf%0AIn PDF document text
    • http://www.zdravazena.sk/images/how-to-get-free-202100-robux.pdf%0AIn PDF document text
    • http://www.boic.nl/images/how-to-cheat-in-roblox-basewars.pdf%0AIn PDF document text
    • http://nevesomost.by/images/roblox-ninja-simulator-2-cheat-engine.pdf%0AIn PDF document text
    • http://escolaarboc.cat/images/free-robux-and-tix-generator-online.pdf%0AIn PDF document text
    • https://www.stkdb.cz/images/roblox-saob-hack.pdf%0AIn PDF document text
    • http://nosocomium.rv.ua/images/free-tix-and-robux-site.pdf%0AIn PDF document text
    • http://www.anies.eu/images/how-to-set-up-pf-pros-roblox-cheats.pdf%0AIn PDF document text
    • https://accord.kiev.ua/images/how-to-get-the-lamborghini-in-roblox-jailbreak-free.pdf%0AIn PDF document text
    • https://gomsa.nl/images/free-card-codes-roblox-2021.pdf%0AIn PDF document text
    • https://www.tsdb.com.au/images/how-do-you-send-a-roblox-fottage-of-someone-hacking.pdf%0AIn PDF document text
    • http://learningarabic.co.uk/images/book-wings-roblox-free.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_003_off00004467.bin)

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004467.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4467 23776 bytes
SHA-256: 5e78179e76c3a84430ca9316fdf20797c527d8842b97b7dd409f3bf42e49551c
font_01_sfnt_off00007a97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A97 2836 bytes
SHA-256: fd98c8f6e7c2e74bbd5822409159a93ac5c94da083ae4c2eb269d4284375f9e8
font_02_sfnt_off00008437.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8437 6656 bytes
SHA-256: c2ccef7015da6354a8bfba3146ab010941775f8e70b319db6f709a5007915dd4
font_03_sfnt_off000093dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x93DD 18364 bytes
SHA-256: a56c5b65ab31700444980d79cc4bd384659475efc8bc81f70d7bc62c0a96d0fc