Malicious PDF — malware analysis report

Static analysis result for SHA-256 bff6be779610a627…

MALICIOUS

PDF

34.2 KB Created: 2021-07-02 03:59:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 923ff3b3357e71f5d9e2d08e9661e186 SHA-1: d5148f44caa11645a698d2295dfbe9033a437edd SHA-256: bff6be779610a627cc07ee516f50908bfa8165fdc6f9abf81ab124b982d0fb62
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and exhibits characteristics of an SEO link farm, suggesting a malicious intent to drive traffic to potentially harmful content. The document body and extracted URLs promote "hacks" and "free" game items, which are common lures for malware distribution. While no scripts were directly extracted, the PDF structure and embedded links indicate a high likelihood of malicious activity, possibly involving the download of further payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/speed-hack-roblox-wild-revolvers-game-hack PDF link annotation
    • http://lib.fisipumt.ac.id/repository/blox-pink-robux-free_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/minecraft-java-edition-download-free_GM479516143.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/how-to-get-free-coins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-to-get-free-robux-without-downloading-anything_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-to-get-more-robux-for-free_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/coin-master-free-spins-hack-iphone_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-to-get-a-hacked-account-back-on-roblox-2021_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/wahoo-gaming-co-free-robux_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/hack-spin-coin-master_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/minecraft-java-edition-free-download-for-android_GM479516143.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/roblox-redeem-card-codes-hack_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-gears-on-roblox_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/roblox-2021-free-items_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-to-get-the-rarest-item-on-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/hack-robux-with-no-gift-card_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/free-minecraft-coloring-pages_GM479516143.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-roblox-map_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/game-give-free-robux_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/arsenal-hacks-roblox_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/bot-roblox-game-free_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00002ed8.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x2ED8 21964 bytes
SHA-256: e8535fc134c93e2a437616847128e80ba2018ca51987a9927d05da18fb338cf4
font_01_sfnt_off00005f68.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F68 19436 bytes
SHA-256: 138a60ef0f28582afa22c90c78bda2b95d3b5ef680f0ef01cf6855e893da6d0e

Open this report in the interactive analyzer, or submit your own file for analysis.