Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2d8bb8f5c143ff6…

MALICIOUS

PDF

44.6 KB Created: 2021-06-04 03:33:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-07
MD5: d37887b9dbf61ba8493c618dbaad347e SHA-1: 2a52d271e8afa643a5c8945d545f8cab6a0c6188 SHA-256: b2d8bb8f5c143ff6d92b1a3451b608ad92488a7fd8a9e2fa9f6e5976bc1574fb
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document uses a common lure of 'Free Robux' and 'game hacks' to entice users to click on embedded links. The primary link directs to a suspicious domain known for hosting such lures. While no scripts were explicitly extracted, the PDF structure and heuristics indicate it's designed to redirect users to potentially malicious websites, likely for further exploitation or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/free-robux-codes-game-hack PDF link annotation
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/get-robux-now_GM431946152.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/free-robux-without-verify_GM431946152.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/free-coins-app-for-coin-master_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/coin-master-hack-2021-apk_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/minecraft-bedrock-free_GM479516143.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/free-robux-hack-2021_GM431946152.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/how-to-get-free-robux-easy-on-phone_GM431946152.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/get-free-robux-no-verification_GM431946152.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/freespins-coin-master_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/free-accessories-roblox_GM431946152.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/coin-master-hacks-reddit_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/coin-master-cheats-free-spins_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/coin-master-coin-link_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/hack-minecraft_GM479516143.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/minecraft-education-free_GM479516143.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/coin-master-hack-that-actually-works_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/coin-master-spin-rewards_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/how-to-get-minecraft-for-free-on-ps4_GM479516143.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/coin-master-free-spins-2021_GM406889139.pdfIn PDF document text
    • http://opac.b2p2vrp.litbang.kemkes.go.id/repository/how-to-get-free-robux-no-survey_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005061.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5061 25680 bytes
SHA-256: 1f0ba57f15d4ae8c2d004214a5df7ae607323873df9e8b783422f4191876bf54
font_01_sfnt_off00008c22.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C22 18188 bytes
SHA-256: 7763b0eba74f003993d6ddc379ef756dfeeff7cedd1b34d70c41f8674d393ab3

Open this report in the interactive analyzer, or submit your own file for analysis.