Malicious PDF — malware analysis report

Static analysis result for SHA-256 d104b8b0434be4f1…

MALICIOUS

PDF

35.7 KB Created: 2021-07-03 18:15:43 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: cbaa6f07c15c7497078204403bcc40d7 SHA-1: 74e7586bac71451c0f99a141b74c31f929ac6e2b SHA-256: d104b8b0434be4f10533764278eb45925fb7bc3c97770e5a810a4c64d762a61d
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are structured as SEO-optimized PDF gateways for game hacks and cheats. The presence of a PDF URI heuristic and the ML classifier's high confidence score indicate malicious intent. The document likely serves as a lure to direct users to download malicious files or visit phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/real-coin-master-hack-game-hack
    • http://stmb-multismart.ac.id/perpustakaan/repository/coin-master-free-spins-link-today_GM406889139.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-wings-guest-invasion-roblox_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-robux-with-no-downloads_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/coin-master-fan-page-free-spins_GM406889139.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-software-free-download_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/hack-tool-for-roblox-pc_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-mods-to-hack-robux_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/como-ser-hacker-no-roblox-2021_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-how-send-report-to-hacker_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/h2-account-stealing-hack-roblox_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/freecoins_GM406889139.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/free-robux-without-a-verifacation_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/rexic-roblox-hack-full-lua_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/roblox-prison-life-hacks-2021_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/coin-master-heaven-daily-free-spins-link-today_GM406889139.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/adopt-me-roblox-hacks_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-do-i-get-free-robux_GM431946152.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-to-really-hack-coin-master_GM406889139.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/how-many-villages-are-in-coin-master_GM406889139.pdf
    • http://stmb-multismart.ac.id/perpustakaan/repository/minecraft-mod-updater_GM479516143.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000035df.bin
6dbaaa489faa5bd1b46497388472d5f75516098ef0386b03b44e213d08485b92		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x35DF 22968 bytes
font_01_sfnt_off0000696c.bin
8036c31bb1dfaeb579433bf8ca502beca93f54135728b4f3b0b6b4a98295ab57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x696C 18080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.