Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2faed15ae79b026…

MALICIOUS

PDF

46.5 KB Created: 2021-05-16 06:19:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: f28ae5f79f426ef106fc2ce5eb7aaa01 SHA-1: 30d48fe88645e2aba7d8f4cb618023a5619e2ccf SHA-256: a2faed15ae79b02683f84359b376153819b125fa9f30b73734c1003ff3c56882
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are structured as SEO link farms for game cheats and free currency. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect users to malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8948

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robloxhero.xyz-free-robux-game-hack
    • http://kupidrbpz.hr/images/roblox-bloxburg-free-money_GM431946152.pdf
    • http://kupidrbpz.hr/images/robux-only_GM431946152.pdf
    • http://kupidrbpz.hr/images/how-to-change-your-name-on-roblox-for-free_GM431946152.pdf
    • http://kupidrbpz.hr/images/how-to-get-roblox-premium-for-free-2021_GM431946152.pdf
    • http://kupidrbpz.hr/images/minecraft-bedrock-edition-free-with-java_GM479516143.pdf
    • http://kupidrbpz.hr/images/coin-master-apk-hack-2021-ios_GM406889139.pdf
    • http://kupidrbpz.hr/images/coin-master-links-for-free-spins-2021_GM406889139.pdf
    • http://kupidrbpz.hr/images/free-robux-just-enter-username-and-password_GM431946152.pdf
    • http://kupidrbpz.hr/images/robux-sign_GM431946152.pdf
    • http://kupidrbpz.hr/images/coin-master-links-for-today_GM406889139.pdf
    • http://kupidrbpz.hr/images/coin-master-free-in-app-purchases_GM406889139.pdf
    • http://kupidrbpz.hr/images/noob-vs-pro-vs-hacker-vs-god-minecraft_GM479516143.pdf
    • http://kupidrbpz.hr/images/coin-master-free-spins-and-coins-today-gift-reward_GM406889139.pdf
    • http://kupidrbpz.hr/images/coin-master-free-spins-link-no-verification-2021_GM406889139.pdf
    • http://kupidrbpz.hr/images/coin-master-hack-2021_GM406889139.pdf
    • http://kupidrbpz.hr/images/static-moonactive-net-free-spins-coin-master_GM406889139.pdf
    • http://kupidrbpz.hr/images/coin-master-hack-no-human-verification-2021_GM406889139.pdf
    • http://kupidrbpz.hr/images/free-coins-and-spins-2021_GM406889139.pdf
    • http://kupidrbpz.hr/images/how-to-get-free-robux-for-free_GM431946152.pdf
    • http://kupidrbpz.hr/images/coin-master-34-4-free-download_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a42.bin
cebe99af30d2fd028c3f9f3a254192595486bfea0489db187ddbded997457c55
pdf-font-stream PDF embedded font (sfnt) at offset 0x4A42 25632 bytes
font_01_sfnt_off0000853b.bin
450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139
pdf-font-stream PDF embedded font (sfnt) at offset 0x853B 5696 bytes
font_02_sfnt_off0000924c.bin
d96645d743d7bc7e16305d404e9ae036d13b2ec1544ce4a3e073a2af54c3cd1e
pdf-font-stream PDF embedded font (sfnt) at offset 0x924C 18584 bytes