Malicious PDF — malware analysis report

Static analysis result for SHA-256 aafecdbdf01b7b79…

MALICIOUS

PDF

34.5 KB Created: 2021-07-05 07:56:08 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: ec1e60b57373d7701a3f1a2c19d11aa7 SHA-1: ef8661179c115f5759d89e8d9b1af66906cd454b SHA-256: aafecdbdf01b7b79f061b000052e02e25e2080df191bf024b5a9211fbcecffe8
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to external websites, many of which are presented as resources for hacking or obtaining free items in games like Coin Master and Roblox. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of such links, suggesting a tactic to drive traffic to potentially malicious sites. The ML classifier also strongly flagged this PDF as malicious. The presence of embedded URLs and the overall structure point towards a phishing or scam attempt, likely using a spearphishing attachment as the initial access vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/hack-coin-master-site-rssingcom-game-hack PDF link annotation
    • http://opac.salatiga.go.id/slims7/repository/i-get-free-robux_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-to-hack-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/is-there-a-way-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/account-hacking-software-roblox_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/coin-master-heaven-daily-free-spins_GM406889139.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-to-get-free-robux-2021-hack_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/coin-master-free-spin-trick_GM406889139.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/how-to-hack-to-get-robux_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/hoz-to-hack-roblox-qcc_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/free-gold-suit-roblox_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/how-to-hack-peoples-roblox-accounts_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-to-get-free-robux-no-inspect-or-hack_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/roblox-hack-phantom-forces-2021_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/coin-master-apk-hack-3527_GM406889139.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-to-get-free-robux-on-iphone-6_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/free-printable-roblox-invites_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/10-roblox-gift-card-free_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7/repository/how-to-cheat-on-risky-strats-roblox_GM431946152.pdfIn PDF document text
    • http://opac.salatiga.go.id/slims7//repository/how-to-get-robux-for-free-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000302e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x302E 23112 bytes
SHA-256: 5e698c787de6e0001932c0100f0e9e1d6a395e96628068f0dabe191c7917b2df
font_01_sfnt_off0000644d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x644D 18264 bytes
SHA-256: 7088da5e0196f232e09bdca4236bad0bb4713a8adc41f1a7b39dc4c057b3a159

Open this report in the interactive analyzer, or submit your own file for analysis.