Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbcb494f54076f2f…

MALICIOUS

PDF

47.4 KB Created: 2021-05-12 17:33:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 8a64e976b5490ba417c47efbf99ceb26 SHA-1: 6d9183a5322f1cc344bf7b3c3c6431c1bda973d8 SHA-256: cbcb494f54076f2feb18abd42b43faadd0e70e17832823d0e35aa0198c5f294f
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are structured as SEO link farms for game hacks. The document body, though partially corrupted, contains references to "Robux Hack Tools" and a URL associated with such content. The presence of a large number of external links and the nature of the content suggest a phishing or scam attempt, likely to lead users to malicious sites or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9888

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • External URI info PDF_URI
    PDF contains an external URL action
  • PDF differential parser failed info PDF_DIFFERENTIAL_PARSE_FAILED
    The cross-check parser (pdfminer.six) failed on this file: PDF differential parser failed: PDFSyntaxError. Static heuristics still ran and any of their findings above are valid; only the differential cross-check signal is missing.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-hack-tools-game-hack PDF link annotation
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-hack-spins-free_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/roblox-hack-scripts-pastebin_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/how-to-hack-coin-master-cheat-engine_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-free-spin-link-today-50_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/free-robux-hack-us_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-free-pet-food-links_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/blogger-free-spins-and-coins_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/can-you-really-hack-coin-master-ios_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/roblox-game-free-download_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-free-spins-and-coins-2021_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/roblox-assassin_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/free-spins-coin-master-hack-2021_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/free-minecraft-accounts-2021_GM479516143.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/how-to-earn-free-robux_GM431946152.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/minecraft-bedrock-free-server-hosting_GM479516143.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-hack-ios-no-human-verification_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/earn-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/coin-master-free-spins-hack-iphone_GM406889139.pdfIn PDF document text
    • https://daringmanbs.manbengkuluselatan.sch.id/__statics/gudangsoal/files/free-roblox-gift-card-codes-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004c30.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4C30 27408 bytes
SHA-256: 6b1e79fb01e88772dd1484fbb7bcddd342d0561e29f24a6860eb0515bb8177bd
font_01_sfnt_off00008c17.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C17 5696 bytes
SHA-256: 450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139
font_02_sfnt_off00009929.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9929 18320 bytes
SHA-256: cf6d0fcc2a7c18e0ae1e84145e037068603b130caaef77e993c358e364abbe1e

Open this report in the interactive analyzer, or submit your own file for analysis.