Malicious PDF — malware analysis report

Static analysis result for SHA-256 adf12b7ecb19973d…

MALICIOUS

PDF

33.9 KB Created: 2021-06-28 05:15:52 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: a7248a44063cf71e11ef15687973e0bd SHA-1: 09b4e0c60f82460020c1bbf7d253340b78d7987c SHA-256: adf12b7ecb19973dc31a3d920cac58843613056f89bc8de07b350859ef52593c
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded URLs and text referencing game cheats and hacks, aiming to trick users into downloading malicious content. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK specifically flags a URL pointing to known malicious infrastructure, indicating a high likelihood of malware distribution. The ML classifier also strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/robux-cheat-engine-6.4-download-game-hack In PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-robeats-hack_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-god-mode-cheat-engine-script_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-to-get-free-robux-with-no-verification_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-to-create-a-minecraft-server-for-free_GM479516143.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-download-game-free_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/what-happens-if-roblox-catches-you-hacking-robux_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox36com-free-robux_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/daily-coin-master-free_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-spins-on-coin-master-app_GM406889139.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-new-robux-hack_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/rb-lx-free-robux_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/minecraft-auto-miner-hack_GM479516143.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-hacker-mask-on-roblox_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/fart-attack-roblox-hack_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-to-hack-in-roblox-on_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-robux-awards_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/buy-tiktok-followers-free_GM835599320.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-to-get-free-robux-no-verification-2021_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/cmd-hack-roblox-jailbreak_GM431946152.pdfIn PDF document text
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-to-get-free-robux-hack-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002b98.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2B98 22284 bytes
SHA-256: ca300d976d7e3efaa58284e53872866902a0c4e6bca8b5c0b2ec9e1075f93efc
font_01_sfnt_off00005d5a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5D5A 19816 bytes
SHA-256: 46e7af6a3cc451b9ce88e070726960f62d6c7f5f35d8733df1d015d238397a48

Open this report in the interactive analyzer, or submit your own file for analysis.