Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f85ce772fff8159…

MALICIOUS

PDF

41.1 KB Created: 2021-04-03 17:15:56 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 8cec1a6a725b7e3a6a4f8d2a82e58c63 SHA-1: 61448a65d1d90df142d7245858d4b6f5e2564751 SHA-256: 7f85ce772fff81590c1ce9ef449c8308caa6a345eff256c8faf31ddf7680136b
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of links to websites promising game hacks and free currency, indicative of a scam or phishing operation. The heuristic firings, particularly 'PDF_GAME_HACK_SEO_LINK_FARM', strongly suggest this is a link farm designed to lure users to potentially malicious sites. While no scripts were explicitly extracted, the nature of the content and the embedded URLs point towards a social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9500

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/hack-fly-roblox-2021 PDF link annotation
    • http://www.eaapiaria.es/images/free-roblox-email.pdf%0AIn PDF document text
    • http://www.brtes.com/images/free-robux-glitch-2021.pdf%0AIn PDF document text
    • http://www.cosver.nl/images/big-paintball-roblox-immortal-hack.pdf%0AIn PDF document text
    • http://agrao.in/images/how-to-script-hack-on-roblox.pdf%0AIn PDF document text
    • https://bancroftandsons.com/images/robux-cheats-no-verification.pdf%0AIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/roblox-on-ps4-free.pdf%0AIn PDF document text
    • http://www.eurosan1.ba/images/roblox-jailbreak-money-hack-download-2021.pdf%0AIn PDF document text
    • http://pa-tanjungselor.go.id/images/roblox-medieval-warfare-reforged-hacks.pdf%0AIn PDF document text
    • https://fkg.usu.ac.id/images/cool-free-robux.pdf%0AIn PDF document text
    • http://svp-steinmaur.ch/images/roblox-hack-extension.pdf%0AIn PDF document text
    • http://www.eurologistiki.gr/images/how-to-hack-roblox-accounts-2021.pdf%0AIn PDF document text
    • http://www.copoint.co.uk/images/invisibleble-hack-roblox-wearedevs.pdf%0AIn PDF document text
    • https://www.dierenartsberghman.be/images/www-roblox-hack-com.pdf%0AIn PDF document text
    • http://bkd1.balikpapan.go.id/images/roblox-hack-script-download.pdf%0AIn PDF document text
    • http://agrao.in/images/roblox-hack-inspect-element-2021.pdf%0AIn PDF document text
    • http://www.malonmalon.com.ar/images/free-robux-instant-hack.pdf%0AIn PDF document text
    • http://www.gadanie.lv/images/roblox-ben-10-free-download.pdf%0AIn PDF document text
    • http://www.pcclawyers.com.au/images/code-pin-free-roblox.pdf%0AIn PDF document text
    • http://agrao.in/images/free-money-roblox-pc.pdf%0AIn PDF document text
    • https://www.lavigny.ch/images/roblox-hacks-x-ray-2021.pdf%0AIn PDF document text
    • http://sscclc.edu.ec/images/how-to-cheat-in-legends-of-speed-race-roblox.pdf%0AIn PDF document text
    • http://www.tamogatoweb.hu/images/roblox-hacking-script-hub.pdf%0AIn PDF document text
    • http://www.lycee-langevin-wallon.com/images/cheats-to-roblox-jailbreak.pdf%0AIn PDF document text
    • http://hemmet-strand.dk/images/how-to-get-free-shirts-on-roblox-no-bc-2021.pdf%0AIn PDF document text
    • https://www.foodsafety.cz/images/free-20210-robux.pdf%0AIn PDF document text
    • https://www.romedia.gr/images/vip-server-free-roblox.pdf%0AIn PDF document text
    • https://pemadamapi.net/images/roblox-free-stuff-catalog.pdf%0AIn PDF document text
    • https://www.udivadlahotel.cz/images/free-animals-from-roblox.pdf%0AIn PDF document text
    • http://www.torvet11.dk/images/dog-roblox-free-costume-make.pdf%0AIn PDF document text
    • https://www.milewood.co.uk/images/how-to-how-to-get-free-robux-on-roblox.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off00004345.bin)

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004345.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4345 26440 bytes
SHA-256: b60b67f450c545cb247134082cc57f54169841450b6e88a2fa63e99f529e2485
font_01_sfnt_off00007dfb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7DFB 18016 bytes
SHA-256: e72cf28c6a650a2730d1a5b808dd5e2540a1734a70be0899842bbc6bbc0da754