Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1b1a052657bc6a6…

MALICIOUS

PDF

43.7 KB Created: 2021-05-13 00:06:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 4d03f5563eda1c88a5a7c37eb6c3eeda SHA-1: 515819e1d5167ba22ba9ba7c6b70a9f9b9e63c9d SHA-256: a1b1a052657bc6a60dbfd0fcbc5b192f59cf785af22c3bf63715f59d0a656ca1
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links and a 'link farm' pointing to various game-related hack and generator sites, including one directly using an IP address. The document body and embedded links suggest a lure for free game items, likely to trick users into downloading malware or visiting malicious sites. The ML classifier strongly indicated maliciousness, and the PDF structure with extensive external links supports a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/free-minecraft-account-and-password-generator-game-hack PDF link annotation
    • http://110.232.83.89/slimsppks/repository/coin-master-hack-ios-cydia_GM406889139.pdfPDF link annotation
    • http://110.232.83.89/slimsppks/repository/free-minecraft-servers-to-join_GM479516143.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/free-robux-no-download_GM431946152.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/coin-master-hack-fast-org_GM406889139.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/can-you-make-a-minecraft-server-for-free_GM479516143.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/can-i-get-robux-for-free_GM431946152.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/coin-master-spin-hack-no-verification_GM406889139.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/coin-master-spin-link-hack_GM406889139.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/daily-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/is-minecraft-realms-free_GM479516143.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/coin-master-gold-cards-free_GM406889139.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/roblox-promo-codes-for-free-robux_GM431946152.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/coin-master-free-spins-today-daily-links_GM406889139.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/hacks-for-minecraft-bedrock_GM479516143.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/coin-master-hack-spin_GM406889139.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/free-minecraft-gift-codes_GM479516143.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/how-to-get-minecraft-for-free-on-laptop_GM479516143.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/free-spins-coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/minecraft-pe-free-download_GM479516143.pdfIn PDF document text
    • http://110.232.83.89/slimsppks/repository/free-robux-generator-without-verification_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004d6a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4D6A 25612 bytes
SHA-256: 8d2c7b9d697266c7e71c29144d0623b97e155b0a7c4a18b3bb0a90f45e82c570
font_01_sfnt_off00008859.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8859 18344 bytes
SHA-256: cdc45183fd3a366ec771f9a19574e583e33f21726cf21e4bc9e9e1e7a2297661

Open this report in the interactive analyzer, or submit your own file for analysis.