Malicious PDF — malware analysis report

Static analysis result for SHA-256 bae6a0d79c39544b…

MALICIOUS

PDF

46.6 KB Created: 2021-05-11 16:01:34 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 786bdbdf21b150d370d893c6d90e9870 SHA-1: 6a7bceb1871e27cc9b8bc1493d7f4e62f75973a4 SHA-256: bae6a0d79c39544b94228f547a8d6b83130dad5243ac72763d72db110b3bf518
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified as a link farm, with a primary malicious URL pointing to 'https://netcdn.xyz/app/479516143/mcpe-game-hack'. The ML classifier also flagged this PDF as malicious. The presence of embedded URIs and the link farm structure strongly suggest an attempt to redirect users to potentially harmful content, likely for malware distribution or phishing. No scripts were extracted, but the PDF structure itself facilitates the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8726

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/479516143/mcpe-game-hack
    • https://opac.umrah.ac.id/repository/good-free-minecraft-server-hosting_GM479516143.pdf
    • https://opac.umrah.ac.id/repository/free-robux-hacks-no-verification_GM431946152.pdf
    • https://opac.umrah.ac.id/repository/what-is-exploiting-in-roblox_GM431946152.pdf
    • https://opac.umrah.ac.id/repository/free-robux-hack-us_GM431946152.pdf
    • https://opac.umrah.ac.id/repository/lucky-patcher-coin-master-hack_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/free-spins-coin-master-cheats_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/hack-coin-master-for-free_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/free-robux-no-survey-or-human-verification_GM431946152.pdf
    • https://opac.umrah.ac.id/repository/coin-master-free_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/free-links-to-coin-master_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/free-coins-coin-master-2021_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/flip-master-free-coins_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/free-robux-promo-codes-2021_GM431946152.pdf
    • https://opac.umrah.ac.id/repository/how-to-get-free-robux-website_GM431946152.pdf
    • https://opac.umrah.ac.id/repository/free-executors-for-roblox_GM431946152.pdf
    • https://opac.umrah.ac.id/repository/coin-master-spin-cheat_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/today-coin-master-free-coins-link_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/free-minecraft-windows-10-with-java_GM479516143.pdf
    • https://opac.umrah.ac.id/repository/moonactive-free-spins-coin-master_GM406889139.pdf
    • https://opac.umrah.ac.id/repository/rewards-roblox-com_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004a72.bin
fb0d22b5290eba341c88a28ee659e3b08e494642efeef1ef6bbc768bfc9fcf1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A72 24672 bytes
font_01_sfnt_off000081d8.bin
f1a29adcea636583330be8db4f6466410de551ac48576b9e1aa5c34e2d665a1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81D8 3020 bytes
font_02_sfnt_off00008c2d.bin
4555740682277f0055d57b15bd0ba953e5b51415ea3d21c93db391eace072d4f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C2D 2816 bytes
font_03_sfnt_off0000963e.bin
bad2551fb36a1ff37c0a2928a0b0bdd7baf715808b6c6c89c87aa6c39ddc14cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x963E 17292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.