Malicious PDF — malware analysis report

Static analysis result for SHA-256 c98e19581cc1bef0…

MALICIOUS

PDF

35.1 KB Created: 2021-06-30 11:58:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: be90e8fe30212243639d5096d1d553b1 SHA-1: 9475627761eb7b743b10b0bdcabc25d1830edd78 SHA-256: c98e19581cc1bef0cbd25352fc26f35c05f7be2a5a9634dbf29425ba3dc197cb
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links, including a prominent one to 'netcdn.co' that is flagged as a game hack lure. The document body and extracted URLs suggest a social engineering attempt to trick users into visiting potentially malicious sites related to game cheats and free items. While no scripts were explicitly extracted, the PDF structure and embedded URLs indicate a malicious intent to redirect users, likely for credential harvesting or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-stuff-in-roblox-catalog-2021-game-hack PDF link annotation
    • http://pustaka.ust.ac.id/repository/how-to-hack-coin-master-with-game-guardian_GM406889139.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/roblox-medieval-warfare-reforged-how-to-hack_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/free-robux-no-need-to-do-anything_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/how-to-hack-coin-master-game-ios_GM406889139.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/how-do-you-earn-robux-in-roblox-for-free_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/coin-master-free-spin-link-today-2021_GM406889139.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/free-daily-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/hack-robux-pastebin-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/free-promo-codes-roblox-october-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/roblox-hack-item-for-free_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/change-roblox-username-free_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/coin-master-free-spins-link-2021-blogger_GM406889139.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/instagram-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/free-robux-no-apps_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/how-to-hack-roblox-for-free-robux-2021-without-waiting_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/coin-master-mod-version-free-download-ios_GM406889139.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/free-robux-that-actually-works-2021_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/robux-free-nuevo-hack_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/how-to-hack-all-faces-in-roblox_GM431946152.pdfIn PDF document text
    • http://pustaka.ust.ac.id/repository/coin-master-download_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003123.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3123 22516 bytes
SHA-256: fed8e225ba13306d363a84c5a4d2f3c414ced56d3b05741ebe3ce038c7e84242
font_01_sfnt_off00006374.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6374 19296 bytes
SHA-256: 5e6e0fc29d483faa01a58977594a235805d3736e7777761f99ca270def46e67c

Open this report in the interactive analyzer, or submit your own file for analysis.