Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb11ab575019d89a…

MALICIOUS

PDF

36.0 KB Created: 2021-07-02 04:48:08 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 325c1a46da74f19e3a77620fda516ef5 SHA-1: 6a987eb718c9b73b64d67027b452e911ba314e02 SHA-256: bb11ab575019d89ab2553c1fa79d63227af8fc2d0c93c2b740a96b1ef204f333
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded links, many of which point to resources related to Roblox game hacks and exploits. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, and the 'ML_NYX_PDF_MALICIOUS' score is very high, suggesting malicious intent. The document's content and structure strongly indicate a phishing or social engineering attempt to trick users into downloading potentially harmful files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-lvl-7-script-executor-free-mac-game-hack
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/how-to-download-roblox-mm2-hacks_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/roblox-download-for-windows-7-free_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/roblox-hack-ga_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/roblox-electric-state-darkrp-hack-money-script_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/free-robux-promo-codes-may-2021_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/apps-to-get-free-robux_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/roblox-guess-that-song-rap-and-pop-cheat-sheet_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/roblox-how-to-open-cheat-engine-without-shut-down_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/how-to-get-private-servers-on-roblox-free_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/claim-free-spins-coin-master_GM406889139.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/free-robux-roblox-promo-codes_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/roblox-admin-commands-hack_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/where-is-the-hacking-station-clone-tycoon-2-roblox_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/roblox-how-to-give-self-free-robux_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/this-color-combanation-gves-you-free-robux_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/how-to-get-hair-on-roblox-that-costs-robux-free_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/free-exploit-roblox_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/roblox-needs-more-space-but-1tb-free_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/free-colouring-in-roblox_GM431946152.pdf
    • http://simpt.stikesmitrakeluarga.ac.id/cendana/repository/fre-dantdm-hair-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003581.bin
132083fff7e7be6fc2f1a01593a8f602f09e3f35691afa2d428a5a5e834c4af3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3581 21968 bytes
font_01_sfnt_off00006637.bin
1ac48407774b02155b8402490165acbc3a9ee335e2e10e7fce161a1a79231fb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6637 19556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.