Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1b23ee323bc6a9a…

MALICIOUS

PDF

35.0 KB Created: 2021-07-04 05:44:45 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: fb51f2b728bca06052d197a3aecb7e2c SHA-1: 2224ecee323f6fb15d51a9a7acf28ec34d93f5bd SHA-256: a1b23ee323bc6a9afc705fa4edb0f0116e0eba2672293b609eb6ad55d9d8ed27
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains multiple links, including one to 'netcdn.tw', which is flagged as a game hack lure. The document's primary purpose appears to be directing users to potentially malicious websites offering game cheats or currency. No scripts were extracted, but the embedded URLs and heuristic firings strongly suggest a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/greasy-fork-roblox-hack-game-hack PDF link annotation
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-to-get-free-bc-tbc-obc-on-roblox-2021_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/roblox-assassin-hack-2021_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-to-get-a-free-dragon-adopt-me-roblox_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/coin-master-free-spins-and-coins-2021_GM406889139.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/get-free-robux-without-human-verification_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/grabpoints-robux_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/free-roblox-accounts-2021-december_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/pop-slots-free-vegas-casino-slots-machine-game-coin-master_GM406889139.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-to-get-free-coins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/free-robux-real-2021_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/sites-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/roblox-island-royale-script-2021-hack_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/free-robux-without-verification-or-survey_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-hack-roblox-accounts_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/glitch-to-get-free-t-shirt-roblox_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/free-spins-from-coin-master_GM406889139.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/free-robux-2021-no-human-verification_GM431946152.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/hack-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/minecraft-bedrock-server-hosting-free_GM479516143.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-to-get-free-robux-codes-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33C3 21848 bytes
SHA-256: b6b99d98332db1726e54cf2c494ef65d64d13a814cbc80796079ae4c3ca7bd14
font_01_sfnt_off00006447.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6447 18812 bytes
SHA-256: 797de3e3c7508d29b8b9fa4fb443c92f94f8c395ec0bd74a59dada57a1250b68

Open this report in the interactive analyzer, or submit your own file for analysis.