Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9602c8ce18faa79…

MALICIOUS

PDF

35.0 KB Created: 2021-06-19 20:08:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 111573b8a7efbe4b72ba8dced06e28f3 SHA-1: 662c34860bbd7696dbb567efcd3d91dc165d0071 SHA-256: a9602c8ce18faa798eb00fb4d04c758afa98ba9db2db0de3a31edfcfaa8acee7
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a document body that promotes free giveaways for popular games, acting as a lure. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, suggesting a link farm or redirection scheme. The ML_NYX_PDF_MALICIOUS score of 0.998 strongly suggests malicious intent, likely to redirect users to phishing or malware download sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-robux-giveaway-group-game-hack PDF link annotation
    • http://uristdona.ru/images/roblox-skins-boy-free_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/coin-master-free-chest-link_GM406889139.pdfIn PDF document text
    • http://uristdona.ru/images/free-disney-plus-accounts-tiktok_GM835599320.pdfIn PDF document text
    • http://uristdona.ru/images/robloxmatchcom-free-robux_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/tutorial-avanzado-de-cheat-engine-para-dragon-ball-rage-roblox_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/hack-para-coin-master-singapore_GM406889139.pdfIn PDF document text
    • http://uristdona.ru/images/free-roblox-toy-codes_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/how-to-hack-someones-roblox-account_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/pubg-uc-whatsapp-group_GM1330123889.pdfIn PDF document text
    • http://uristdona.ru/images/hacked-roblox-game_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/free-spins-coin-master-no-human-verification_GM406889139.pdfIn PDF document text
    • http://uristdona.ru/images/minecraft-windows-10-hacked-client_GM479516143.pdfIn PDF document text
    • http://uristdona.ru/images/coin-master-free-spins-link-today-new_GM406889139.pdfIn PDF document text
    • http://uristdona.ru/images/promo-codes-roblox-robux-free_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/free-tiktok-followers-quick-and-easy_GM835599320.pdfIn PDF document text
    • http://uristdona.ru/images/how-to-hack-on-vehile-simualotor-roblox_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/coin-master-root-hack_GM406889139.pdfIn PDF document text
    • http://uristdona.ru/images/free-spins-coin-master-blogspot_GM406889139.pdfIn PDF document text
    • http://uristdona.ru/images/how-to-hack-roblox-big-brother_GM431946152.pdfIn PDF document text
    • http://uristdona.ru/images/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003075.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3075 22612 bytes
SHA-256: ac336d7c1129a5457c5e0804c948073356f89cf97d6a6abb0ba534030ebe5310
font_01_sfnt_off000062df.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62DF 19284 bytes
SHA-256: 76f4214bb68643998b2257ad3c387f22efc5c49e3fb3cda792e402fade6add53

Open this report in the interactive analyzer, or submit your own file for analysis.