Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1af34c47739f608…

MALICIOUS

PDF

35.1 KB Created: 2021-06-19 21:36:43 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: bbac38dd47257e7da5b739e74337a3a6 SHA-1: 3c6e27fc6849e3797f510ace19bc54054a59d561 SHA-256: a1af34c47739f608a8697c38d2ac1dc50eea7f78f45e2531f08b3e1e94b5e643
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains numerous embedded URLs and a document body that explicitly advertises "Hacking Programs" and "Free Robux" generators. The heuristic PDF_SEO_LINK_FARM indicates a mass of external links, suggesting a link farm or SEO poisoning tactic. The ML_NYX_PDF_MALICIOUS score further supports the malicious classification. The presence of download-related text and numerous external links points to a phishing or scam attempt designed to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/hacking-program-for-roblox-to-hack-accounts-game-hack
    • http://digilibfisip.unla.ac.id/repository/daily-free-spins-coin-master-2021_GM406889139.pdf
    • http://digilibfisip.unla.ac.id/repository/coin-master-hack-with-facebook-login_GM406889139.pdf
    • http://digilibfisip.unla.ac.id/repository/how-to-get-free-robux-without-password-or-hacking_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/free-roblox-com_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/hack-tool-for-roblox-pc_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/free-roblox-svg_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/roblox-script-hack_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/free-spins-for-coin-master-hack_GM406889139.pdf
    • http://digilibfisip.unla.ac.id/repository/how-to-use-hacks-on-roblox_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/demogorgon-roblox-free-body_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/can-u-get-free-robux_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/how-to-get-roebucks-in-roblox_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/roblox-speed-hack-download-free-2021_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/download-roblox-hack-2021_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/how-to-get-free-robux-no-scams-2021_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/free-robux-no-human-verification-or-survey-2021_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/robux-premium_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/stock-speed-coin-master-free-spins_GM406889139.pdf
    • http://digilibfisip.unla.ac.id/repository/hack-de-sexo-roblox-tutorial_GM431946152.pdf
    • http://digilibfisip.unla.ac.id/repository/free-robux-no-downloading-apps_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003093.bin
aeff40b416a7003e19e8df6155ba900bf24034b9569a91fecb175a309c224d11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3093 22644 bytes
font_01_sfnt_off000062af.bin
506bc3ab7fa1244e5bda8beecbe8828df1fe35140bc8da28f2d047f6586afc92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62AF 19600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.