Malicious PDF — malware analysis report

Static analysis result for SHA-256 91ecbb6cfc11ce4d…

MALICIOUS

PDF

34.9 KB Created: 2021-06-19 16:36:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 2a0f6f7a642750eff9e2ca80c71a5aa3 SHA-1: a3615322768fb72827770f2a2df0f9533c173791 SHA-256: 91ecbb6cfc11ce4d0bfc75afc8888fc5257719aa279768165b917485b45388dd
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a large number of external links, many of which are related to game hacks and in-game currency, suggesting a lure for users to download potentially malicious content. The ML classifier also flagged this PDF as malicious with high confidence. The presence of a download button lure and callback phishing lure further supports a malicious intent to trick users into unsafe actions.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/comment-hacker-roblox-android-game-hack
    • http://sgsacall.sgsa.gov.mn/files/editor/files/free-daily-spins-coin-master-2021_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/minecraft-pocket-edition-free-download_GM479516143.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/coin-master-daily-free-spin-app_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/free-coin-master-spins-and-coins_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/roblox-how-to-use-cheat-engine-2021_GM431946152.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/coin-master-free-attack_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/como-sacar-buen-puntaje-en-juego-coin-master-free-spins_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/coin-master-hack-without-human-verification-2021_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/free-robux-images_GM431946152.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/how-to-get-free-robux-fast_GM431946152.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/free-robux-games-on-roblox_GM431946152.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/how-to-hack-a-roblox-account-easy_GM431946152.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/coin-master-hack-co_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/free-spin-coin-master-2021_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/cheat-roblox-roghoul-en-francais_GM431946152.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/how-to-earn-free-robux_GM431946152.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/how-to-play-minecraft-for-free_GM479516143.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/games-like-coin-master-for-free_GM406889139.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/kuso-icu-roblox-hack_GM431946152.pdf
    • http://sgsacall.sgsa.gov.mn/files/editor/files/how-to-hack-any-roblox-account_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003161.bin
53103c5faa8d3630dc3d7e47352c1993a4027e8e780bcc44e3c5404e7595da27		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3161 22364 bytes
font_01_sfnt_off000062ba.bin
9812fd84386ec7cdda142bdd80e10fa93dc2c3f3101e58aec2f4c1280c538325		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62BA 19316 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.