Malicious PDF — malware analysis report

Static analysis result for SHA-256 814a2f4737221f0c…

MALICIOUS

PDF

44.1 KB Created: 2021-06-03 14:49:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: faa67d2a9c542d1b4697999ac54e3d8f SHA-1: e96c0cfff453e66e726d341479e2bbccbf06fa35 SHA-256: 814a2f4737221f0c5a3658a5fc75da6cc25a53b90a27b402fb33222930ce0c1b
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a link farm with numerous SEO-optimized URLs pointing to potentially malicious content, such as game hacks and free accounts. The presence of a download button lure and a high ML classifier score further indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest it's designed to redirect users to external sites for malicious purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/406889139/coin-master-hack-without-verification-for-iphone-game-hack
    • http://lib.smklabor.sch.id/repository/earn-free-robux_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/free-minecraft-server_GM479516143.pdf
    • http://lib.smklabor.sch.id/repository/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/get-free-robux-no-verification_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-free-link-app_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/how-to-get-free-robux-without-verification-2021_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/minecraft-hacks-ps4_GM479516143.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-free-spins-for-today_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/roblox-hacked-accounts-list_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/haktuts-coin-master-free-daily-spins_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/games-in-roblox-that-give-you-robux_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-daily-free-spins-link-today-2021_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/free-cracked-minecraft-server-hosting_GM479516143.pdf
    • http://lib.smklabor.sch.id/repository/free-coin-master-spins-2021_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-heaven-free-spins_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/free-spins-coin-master-links-blogspot_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-free-spins-promo-code_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-unlimited-spin-hack-mod-apk_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/free-minecraft-accounts-reddit_GM479516143.pdf
    • http://lib.smklabor.sch.id/repository/free-robux-for-kids-no-verification_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000510c.bin
ee0c84e0d30e0a66fcb06bb9d468159cf2d0f501a93ad63ed2357dfa9370942f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x510C 24556 bytes
font_01_sfnt_off00008892.bin
b0c3a89d711ec100aafe578ee7b28ea2727b66157cc397f5079d3cb8995e9fec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8892 18696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.