PDF malware analysis — malicious · 991a5f084937b79b

MALICIOUS

PDF

34.0 KB Created: 2021-06-18 20:07:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: da0522bdf5ce1a41ae88d1d9d5e671c3 SHA-1: dc313c2950f76c9188c57588e8e058a93bb33418 SHA-256: 991a5f084937b79bc423f142391911f6b18d1d02eee5a5cde1a59b6bc989bd9a

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded links, many of which point to external resources related to game hacks and cheats. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of such links, suggesting a tactic to drive traffic to potentially malicious sites. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/hacks-for-roblox-vehicle-simulator-game-hack
- http://algierimasonry.com/images/draw-it-hacks-roblox_GM431946152.pdf
- http://algierimasonry.com/images/earn-robux-today_GM431946152.pdf
- http://algierimasonry.com/images/coin-master-free-spins-heaven_GM406889139.pdf
- http://algierimasonry.com/images/free-roblox-accounts-with-robux-2021_GM431946152.pdf
- http://algierimasonry.com/images/free-coin-master-spins-and-coins-for-daily_GM406889139.pdf
- http://algierimasonry.com/images/free-codes-for-roblox-case-clicker_GM431946152.pdf
- http://algierimasonry.com/images/coin-master-free-daily-spins-link_GM406889139.pdf
- http://algierimasonry.com/images/coin-master-free-spins-ios-app_GM406889139.pdf
- http://algierimasonry.com/images/coin-master-free-spins-hack-but-no-surveys_GM406889139.pdf
- http://algierimasonry.com/images/usar-hacks-en-roblox_GM431946152.pdf
- http://algierimasonry.com/images/how-to-hack-roblox-accounts-2021-easy_GM431946152.pdf
- http://algierimasonry.com/images/how-to-get-free-robux-on-roblox-2021-ipad_GM431946152.pdf
- http://algierimasonry.com/images/roblox-promo-codes-free-robux_GM431946152.pdf
- http://algierimasonry.com/images/how-do-i-get-free-spins-on-coin-master_GM406889139.pdf
- http://algierimasonry.com/images/daily-coin-master-free_GM406889139.pdf
- http://algierimasonry.com/images/coin-master-sound-daily-free-spins-link-today_GM406889139.pdf
- http://algierimasonry.com/images/coin-master-free-link-blogspot_GM406889139.pdf
- http://algierimasonry.com/images/unlimited-robux-2021_GM431946152.pdf
- http://algierimasonry.com/images/giving-away-free-robux-cards_GM431946152.pdf
- http://algierimasonry.com/images/free-robux-codes-2021-not-used_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002eb5.bin` `8b2e1ddc897f3e3485fcfaf4822c6f3779e9623281fe561fb3e1c3448d7f5dcd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2EB5	21716 bytes
`font_01_sfnt_off00005e9b.bin` `020bedfb5a83b306f2017b4d5aeb6bbf633b8266a52088110ce822ab4d3139d1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E9B	19560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.