Malicious PDF — malware analysis report

Static analysis result for SHA-256 99b5373a8e10d63b…

MALICIOUS

PDF

44.6 KB Created: 2021-05-16 05:00:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 122d4d6442b91e2b11e06b90fa59d156 SHA-1: d4e42eb7aecbc9bd7f30eb0f7198825097db6127 SHA-256: 99b5373a8e10d63b079188410d51d273362502721dde949e2a4266e4c0923796
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links to external resources, many of which are SEO-optimized PDF files related to game cheats and hacks. The document also displays a fake CAPTCHA, indicating an attempt to trick the user into interacting with the content. The primary URL, https://netcdn.xyz/app/431946152/robloxhacks-game-hack, is likely the final destination for the malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9632

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robloxhacks-game-hack
    • http://panaceafamilymedicine.com/images/coin-master-cheats-and-hacks_GM406889139.pdf
    • http://panaceafamilymedicine.com/images/how-to-get-minecoins-in-minecraft-for-free_GM479516143.pdf
    • http://panaceafamilymedicine.com/images/roblox-gift-card-online-free_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/free-robux-please_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/coinmaster-twitter_GM406889139.pdf
    • http://panaceafamilymedicine.com/images/app-store-coin-master-free-spins_GM406889139.pdf
    • http://panaceafamilymedicine.com/images/how-to-hack-to-get-robux_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/como-hackear-coin-master-en-espaol_GM406889139.pdf
    • http://panaceafamilymedicine.com/images/free-roblox-clothes-codes_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/free-pet-food-coin-master_GM406889139.pdf
    • http://panaceafamilymedicine.com/images/minecraft-pe-free-download-ios-no-jailbreak_GM479516143.pdf
    • http://panaceafamilymedicine.com/images/free-robux-websites-no-human-verification_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/free-robux-games-that-actually-work_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/free-roblox-characters_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/minecraft-114-4-download-free_GM479516143.pdf
    • http://panaceafamilymedicine.com/images/master-hack-coin_GM406889139.pdf
    • http://panaceafamilymedicine.com/images/how-to-get-free-spins-on-coin-master_GM406889139.pdf
    • http://panaceafamilymedicine.com/images/play-games-for-robux_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/free-robux-games-on-roblox_GM431946152.pdf
    • http://panaceafamilymedicine.com/images/coin-master-unlimited-spins_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000047bd.bin
e327eaf4ee225a5e12999234dead54392d5a52e3b6890e530d96cb99dc93ba4d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x47BD 25316 bytes
font_01_sfnt_off00008199.bin
02b35010e2614e3cc95ac6414c49295350c91fdfcc4b4cad27ffdbc10e80df7f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8199 2912 bytes
font_02_sfnt_off00008b95.bin
4c82b5acf2344fb6074e769b7bb8f458d53ebd76102ce4f277dd7245c06f6447		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B95 18348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.