Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2462cebc21f891a…

MALICIOUS

PDF

50.7 KB Created: 2021-06-13 17:53:34 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: b8313a88d40579dec68b45818881b72b SHA-1: e89572c423e5fc3b2c54d3bdb66d46af6a90e080 SHA-256: b2462cebc21f891a4591b5a528064796f29f6c6f17aa33def7e4ca1ece050ae7
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document is designed as a lure, using game-related content like "free Roblox Fashion Frenzy" to entice users. It contains numerous embedded links to external sites, many of which appear to be part of a link farm, and explicitly requests recovery secrets. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9779

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-fashion-frenzy-game-hack
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-i-dont-feel-so-good-simulator-hack_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/cheats-to-roblox-to-get-free-robux_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/free-tiktok-followers-no-downloads_GM835599320.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-jailbreak-games-for-free_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/free-robux-no-human-verification-or-survey-2021-on-ios_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-prison-life-hacks-2021_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/royl-high-roblox-play-roblx-for-free_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/robux-free-hack-no-survey-2021_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/how-to-get-robux-with-cheat-engine-64_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/robux-free-2021_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/2021-roblox-hack_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/hack-1k-robux_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/bloxburg-on-roblox-free-play_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-202120214-for-free_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/moni-production-free-robux_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/how-to-get-free-robux-easy-2021_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/how-do-u-get-free-obc-including-robux_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-exploits-for-mac-free_GM431946152.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/try-minecraft-free_GM479516143.pdf
    • https://taxandmore.nl/wp-content/uploads/fsqm-files/roblox-how-send-report-to-hacker_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000055b0.bin
649ac8346c5d54f86f3ab34ba9721ab187546b9c280b4023229ab005462e9eba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55B0 29864 bytes
font_01_sfnt_off000098d0.bin
d88f25cfe237a714f996150a11dd8a058f0f7c3e9d1ae91c17b46c10409b6c0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x98D0 2820 bytes
font_02_sfnt_off0000a26b.bin
fdf783c616dac5950743bdb20044d425d68c8fba5af07ad8980f117d671d63b0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA26B 18724 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.