Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e54d01ad3eca6e8…

MALICIOUS

PDF

43.7 KB Created: 2021-05-15 12:46:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: dc6c7f91f720fd8ea475f57835898571 SHA-1: 58a98ad664b871d2a65b302a0ce2de63048afbc6 SHA-256: 9e54d01ad3eca6e89747b7e98134dba604de3a244a899a67f5b17af85658988b
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous links to external websites, many of which are structured as SEO link farms for game hacks and free currency. The document also contains instructions to disable security software, a common tactic to facilitate further malicious activity. The ML classifier strongly flagged this PDF as malicious, indicating a high likelihood of it being used to distribute malware or lead users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-games-that-actually-work-game-hack
    • http://geometraperiotto.it/images/free-roblox-app_GM431946152.pdf
    • http://geometraperiotto.it/images/coin-master-hack-tool-2021_GM406889139.pdf
    • http://geometraperiotto.it/images/earn-free-robux-for-roblox_GM431946152.pdf
    • http://geometraperiotto.it/images/coin-master-hack-apk-april-12-2021_GM406889139.pdf
    • http://geometraperiotto.it/images/free-robux-no-survey_GM431946152.pdf
    • http://geometraperiotto.it/images/coin-master-hack-ios-download-2021_GM406889139.pdf
    • http://geometraperiotto.it/images/coin-master-card-hack_GM406889139.pdf
    • http://geometraperiotto.it/images/hack-coin-master-without-root_GM406889139.pdf
    • http://geometraperiotto.it/images/coin-master-hack-apk-download-for-android_GM406889139.pdf
    • http://geometraperiotto.it/images/how-to-hack-and-get-free-robux_GM431946152.pdf
    • http://geometraperiotto.it/images/coin-master-free-spins-that-really_GM406889139.pdf
    • http://geometraperiotto.it/images/best-free-minecraft-servers_GM479516143.pdf
    • http://geometraperiotto.it/images/coin-master-free-coins-and-spins-link_GM406889139.pdf
    • http://geometraperiotto.it/images/how-can-you-get-free-robux_GM431946152.pdf
    • http://geometraperiotto.it/images/how-do-i-get-free-spins-in-coin-master_GM406889139.pdf
    • http://geometraperiotto.it/images/how-to-get-minecraft-for-free-on-xbox_GM479516143.pdf
    • http://geometraperiotto.it/images/how-to-get-free-robux-without-human-verification_GM431946152.pdf
    • http://geometraperiotto.it/images/how-to-hack-in-arsenal_GM431946152.pdf
    • http://geometraperiotto.it/images/how-to-make-a-modded-minecraft-server-for-free_GM479516143.pdf
    • http://geometraperiotto.it/images/coin-master-support_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004c45.bin
160c0e26e9ed5f2e7a8de64908f542acec1a3b3d26759c7355b1273d657ba9ef
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4C45 25044 bytes
font_01_sfnt_off00008539.bin
2bd118a57b53ff37cab680797aee460eb59fed046ceba4ed0277135d7eae5baa
pdf-font-stream PDF embedded font (sfnt) at offset 0x8539 19392 bytes