Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bbcfc16bf93d2c1…

MALICIOUS

PDF

35.9 KB Created: 2021-06-18 17:25:40 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c9137b7f0587e3d34be6ff3749f7d7d1 SHA-1: 8eecccd7424357b6865e6472b35e2b466334b2b5 SHA-256: 9bbcfc16bf93d2c152adc2c6e399a883a85f566024ba5cf74b49520556252cc3
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are SEO-optimized to appear as guides for obtaining free in-game items or currency for popular games. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of such links, suggesting a link farm designed to attract users with deceptive promises. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted, but the presence of many external links points to a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-make-a-cool-free-roblox-acount-game-hack
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/how-to-get-the-marshmallow-head-in-roblox-for-free_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/free-roblox-codes-2021_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/alot-free-robux_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/how-to-get-free-items-on-roblox-may-2021_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/roblox-counter-blox-cheats-crash_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/free-spins-from-coin-master_GM406889139.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/roblox-one-piece-millenium-hack-devil-fruit_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/roblox-jailbreak-nclip-hack-2021-may_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/free-roblox-clothes-for-girl_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/how-to-get-free-robux-2021-easy_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/goo-gl-lmpoqu-free-robux_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/rblx-city-free-robux_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/free-coin-master-spins-blog_GM406889139.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/roblox-hack-gui-download_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/free-roblox-undertale_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/roblox-clown-hack_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/roblox-cheat-speed-run_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/how-to-get-free-gamepass-on-roblox-github_GM431946152.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/how-to-get-java-minecraft-for-free_GM479516143.pdf
    • http://mtsn1kukarelearning.com/__statics/gudangsoal/files/robux-free-verdienen_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003393.bin
590088acdaa224df754a6cd986812536ec57780bebe9a25aee3af667fddb8e97		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3393 22684 bytes
font_01_sfnt_off0000668e.bin
17a5813ea216affe641fc0900ea0f1fcdaef8bad5bd928c93996146e4c4dc352		 pdf-font-stream PDF embedded font (sfnt) at offset 0x668E 19424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.