Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e7d4a0c12f0b7b7…

MALICIOUS

PDF

46.2 KB Created: 2021-05-11 20:36:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 6d0be1c95932e3149687b7898ea51a39 SHA-1: 38d86cf09f7ba6ab2dcb82319b01b4daec50ea50 SHA-256: 7e7d4a0c12f0b7b7065c5c0bea711a44e59f4670e936e455df5b588a18ba0715
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are structured to appear as SEO-optimized content related to game rewards and hacks. The ML classifier also flagged this PDF as malicious with high confidence. The primary goal appears to be driving traffic to these external sites, likely for SEO manipulation or to serve malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9432

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-free-rewards-link-game-hack PDF link annotation
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-free-spins-link-blogspot_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-mod-apk-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-fly-hack_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-game-for-pc-free-download_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/can-u-get-free-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-free-robux-website_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/pig-master-free-spins-and-coins_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-roblox-accounts-with-robux-that-work-not-banned_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-get-free-robux-fast_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-unlimited-coin-master-400-spin-link_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-daily-free-spins-link_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-get-free-robux-generator_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-install-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/is-minecraft-bedrock-free_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/robuxmatch-com-free-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-do-u-hack-roblox_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/www-roblox-com-robux_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/picture-roblox_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-spin-hack-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-free-spins-promo-code_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004da8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4DA8 24996 bytes
SHA-256: 68c9273841f5b3181bfefdb32422e6ad7c809055eb59ff33c66040ef0cb982e1
font_01_sfnt_off00008730.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8730 3124 bytes
SHA-256: 9967c6221325a4ff3f7c4336922605f990450164c2eee2df708cc81823c6ec98
font_02_sfnt_off0000920f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x920F 18216 bytes
SHA-256: 658cfe6ea68dc33f1c61864f727cf80d605750a91b73f2c3ad1e1c3c3fde56a2

Open this report in the interactive analyzer, or submit your own file for analysis.