Malicious PDF — malware analysis report

Static analysis result for SHA-256 c123adfffaf6f4fe…

MALICIOUS

PDF

45.3 KB Created: 2021-05-19 06:40:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 9b3cd639d28a262e3e680832154e9c3d SHA-1: d6a777ea9c44a3b52acd9c48cdec806fbcb16614 SHA-256: c123adfffaf6f4fe10a834ca54d32f050182d152032017e4faa60a8f933d4bb0
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links and a "download button" lure, directing users to external sites that offer "free Robux" or game-related content. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, suggesting a link farm or phishing operation. The ML classifier also flagged the PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of external links and the nature of the lures strongly suggest a phishing or scam attempt, potentially leading to malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9551

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-com-game-hack
    • http://rkh.go.th/ckfinder/userfiles/files/free-robux-on-iphone_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/coin-master-free-spins-link-blogspot_GM406889139.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/games-on-roblox-that-give-you-free-robux_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/how-to-get-free-robux-on-phone_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/get-me-robux-for-free_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/generator-robux_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/websites-that-give-free-robux_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/what-is-coin-master_GM406889139.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/hacking-apps-for-roblox_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/how-to-create-a-minecraft-server-for-free_GM479516143.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/coin-master-free-spins-link-today_GM406889139.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/pubg-uc-price-in-pakistan_GM1330123889.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/pubg-uc-price-in-bd_GM1330123889.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/roblox-data-breach_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/robux-in_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/master-coin-master-free-spin_GM406889139.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/free-coins-coin-master-link-2021_GM406889139.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/free-robux-without-any-verification_GM431946152.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/wurst-115_GM479516143.pdf
    • http://rkh.go.th/ckfinder/userfiles/files/all-free-items-in-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004781.bin
92c10ae1ed43346cc7a0b68678a2282fcca1d59e638d973058ef63b191153333		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4781 26404 bytes
font_01_sfnt_off00008479.bin
889cfc2fd0afa9ea114d6666204c6ce0548d0aae2cba345827d317498c4c06bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8479 2984 bytes
font_02_sfnt_off00008ea5.bin
d7491fe45cc88596c87233a963b6162720bf27c142cea717df16fbc09fa29ea6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EA5 18276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.