Malicious PDF — malware analysis report

Static analysis result for SHA-256 cc26555366ffac50…

MALICIOUS

PDF

46.2 KB Created: 2021-06-09 09:34:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-16
MD5: 57113d7990aec6089b217e56a57c7ce7 SHA-1: 2d3eac4e0ad2ea07a0592ec93e8587e7aaca1e8b SHA-256: cc26555366ffac509c71235ef688abbdb4d511bbb9c56b808781edd61a88b7b4
180 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to external websites, many of which are hosted on an IP address and are flagged as malicious redirectors. The document body, though heavily obfuscated, contains text related to 'free Robux' and 'game hack', suggesting a scam or lure. The presence of a download button heuristic further supports the idea that the document is designed to trick users into clicking malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 5

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL
    PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/get-robux-for-free-for-roblox.com-free4mobile24.com-game-hack In PDF document text
    • http://103.40.122.33/akasia/repository/how-to-get-free-likes-on-tiktok_GM835599320.pdfPDF link annotation
    • http://103.40.122.33/akasia/repository/free-robux-just-enter-username-no-verification_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/free-robux-no-verification-2021-ios_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/coin-master-free-spins-coins_GM406889139.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/cara-cheat-roblox-android_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/coin-master-free-spins-apk_GM406889139.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/how-to-get-infinite-robux-hack_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/how-to-get-free-robux-codes-2021_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/coin-master-hack-https-coinms-net_GM406889139.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/roblox-hacks-com_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/free-robux-games-on-roblox_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/free-robux-games-that-actually-work-2021_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/free-coin-master-cards_GM406889139.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/hacks-for-roblox-prison-life_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/how-to-get-roblox-credit-for-free_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/how-to-get-free-robux-for-real_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/robux-hack-pro_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/how-do-we-get-free-robux_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/games-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • http://103.40.122.33/akasia/repository/pubg-mobile-uc-2021_GM1330123889.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000512b.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x512B 27500 bytes
SHA-256: 2dbd623dd74667b94e43c5657042c2aafec066bbb8483c94491772bd2110f5a0
font_01_sfnt_off0000907d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x907D 18824 bytes
SHA-256: 40ce662e35b60c4c66c90e61c44b34491038f3150345d564f2c2ada8ea4bd0cf

Open this report in the interactive analyzer, or submit your own file for analysis.