Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c038f500fceddec…

MALICIOUS

PDF

48.3 KB Created: 2021-06-09 04:27:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 32f9ae3aa3cc20f75164a9028e7f397b SHA-1: 2bb4858610df5884f2b4ea23f16b01807ee35187 SHA-256: 8c038f500fceddecc9039bb39717e122d54a4dcbf96d42a39bfc64fc00c3d773
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous external links, forming a link farm, with the primary URL pointing to a 'Roblox Lumber Tycoon 2 Hacked Version' lure. The ML classifier strongly flagged this PDF as malicious. While no scripts were directly extracted, the PDF structure and the presence of external links suggest an attempt to redirect users to malicious content, likely for exploitation or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-lumber-tycoon-2-hacked-version-game-hack
    • http://hk-kan.org/images/mine-minecraft-games-for-free_GM479516143.pdf
    • http://hk-kan.org/images/free-spins-coin-master-links-blogspot_GM406889139.pdf
    • http://hk-kan.org/images/coin-master-free-spins-hack-link_GM406889139.pdf
    • http://hk-kan.org/images/coin-master-free-spins-and-coins-app-download_GM406889139.pdf
    • http://hk-kan.org/images/links-to-get-free-spins-on-coin-master_GM406889139.pdf
    • http://hk-kan.org/images/coin-master-hack-without-verification_GM406889139.pdf
    • http://hk-kan.org/images/how-to-hack-a-roblox-account-easy_GM431946152.pdf
    • http://hk-kan.org/images/free-robux-clothes_GM431946152.pdf
    • http://hk-kan.org/images/free-spins-coin-master-app-ios_GM406889139.pdf
    • http://hk-kan.org/images/free-400-spins-coin-master_GM406889139.pdf
    • http://hk-kan.org/images/free-robux-no-verification_GM431946152.pdf
    • http://hk-kan.org/images/coin-master-cheat-codes-free_GM406889139.pdf
    • http://hk-kan.org/images/show-me-how-to-get-free-robux_GM431946152.pdf
    • http://hk-kan.org/images/free-robux-no-verification-no-survey_GM431946152.pdf
    • http://hk-kan.org/images/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdf
    • http://hk-kan.org/images/what-do-points-do-in-roblox_GM431946152.pdf
    • http://hk-kan.org/images/free-roblox-gift-card-codes-reddit_GM431946152.pdf
    • http://hk-kan.org/images/how-to-get-free-stuff-on-roblox_GM431946152.pdf
    • http://hk-kan.org/images/coin-master-free-spins-link-2021_GM406889139.pdf
    • http://hk-kan.org/images/robux-offer-wall_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000052de.bin
e6bcb67a81055ef3581495eda8facf0f092810536f14390546914124536cce7d
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x52DE 25140 bytes
font_01_sfnt_off00008d13.bin
10d025f04f706eb71cdda4f99784df1b9ccb52e48080e43095e0398eaef6f132
pdf-font-stream PDF embedded font (sfnt) at offset 0x8D13 2880 bytes
font_02_sfnt_off000096fd.bin
b4756d4a177f3d71f63594a27fe3362fef9097308b7e09d2061d19e3ce69b23d
pdf-font-stream PDF embedded font (sfnt) at offset 0x96FD 19312 bytes