Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5de9cd0b420759a…

MALICIOUS

PDF

46.0 KB Created: 2021-05-13 07:10:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 5e4e824e656650c41eb4210cb162af92 SHA-1: abfa4000c415c65c72d0667242147155f6883ba5 SHA-256: b5de9cd0b420759a28515ecf1bec972247876bb9b7ec1d4d3d1a454b5428e685
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links disguised as offers for game cheats and codes, such as 'minecraft-redeem-code-free-2021-game-hack'. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm designed to redirect users to potentially malicious sites. The ML classifier also strongly flagged this PDF as malicious. The presence of embedded URLs and the link farm behavior points towards a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9432

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/minecraft-redeem-code-free-2021-game-hack
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/coin-master-free-spins-app_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/free-robux-generator-no-human-verification_GM431946152.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/minecraft-tiktok-hacks_GM479516143.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/chisel-and-bits-mod-minecraft-pe_GM479516143.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/free-robux-hack-no-human-verification_GM431946152.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/coin-master-32-hack-apk_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/ac-market-coin-master-hack_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/free-robux-com_GM431946152.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/how-to-get-robux-easy_GM431946152.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/coin-master-free-spin-ml_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/freerubux_GM431946152.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/robux-free-gift-card-org-hack_GM431946152.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/coin-master-hack-tool-v1-9-download-free-pc_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/coin-master-daily-free-cards_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/free-spins-coin-master-2021-hack_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/roblox-download-pc-free_GM431946152.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/coin-master-daily-free-spins-2021_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/coin-master-free-spins-link-no-verification-2021_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/coin-master-free-spins-today-new_GM406889139.pdf
    • http://pustaka.stitdarulhijrahmtp.ac.id/repository/how-to-hack-and-get-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004c90.bin
4af66e9b375a789e3a920f8904e826eadd7050b52f4a3b589e511fb881e0bb86		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4C90 24868 bytes
font_01_sfnt_off0000859a.bin
47be8c1e362596fa5bd4ed29acf07edad94632e286ba7a52c809fd696d683e5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x859A 3132 bytes
font_02_sfnt_off0000906f.bin
611277ce03819488b0455d760a99d29b8e1d6f4ae34c09b91ed543aef68bda35		 pdf-font-stream PDF embedded font (sfnt) at offset 0x906F 18544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.