Malicious PDF — malware analysis report

Static analysis result for SHA-256 d60cb9d3497a8023…

MALICIOUS

PDF

34.0 KB Created: 2021-06-18 05:49:29 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c7a20faafc1386820ea6a5aa0b833022 SHA-1: 61f82d05a801e3e237a65fb40a39fe51bbfcd30c SHA-256: d60cb9d3497a80233549a48af13bf1e7f4cb4295f62f9af225794ae688063499
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are structured as SEO-optimized PDF gateways for game-related cheats and hacks. The ML classifier strongly indicated maliciousness, and the presence of a download button lure reinforces the deceptive nature of the document. The primary attack pattern involves enticing users to click these links, likely leading to malware downloads or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-vehicle-tycoon-cheats-game-hack
    • http://opac.akafarma-aceh.ac.id/repository/coin-master-game-for-pc-free-download_GM406889139.pdf
    • http://opac.akafarma-aceh.ac.id/repository/is-roblox-free-on-nintendo-switch_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/free-minecraft-texture-packs-java_GM479516143.pdf
    • http://opac.akafarma-aceh.ac.id/repository/free-robux-generator-no-apps_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/how-to-get-free-robux-on-ipad_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/free-robux-pin-codes_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/how-to-hack-a-roblox-account-easy_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/toolbox-for-minecraft_GM479516143.pdf
    • http://opac.akafarma-aceh.ac.id/repository/how-to-hack-roblox-jailbreak-with-cheat-engine_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/how-to-o-get-free-coin-master-spins_GM406889139.pdf
    • http://opac.akafarma-aceh.ac.id/repository/free-daily-coin-master-coins_GM406889139.pdf
    • http://opac.akafarma-aceh.ac.id/repository/minecraft-free-reddit_GM479516143.pdf
    • http://opac.akafarma-aceh.ac.id/repository/giftrobux-com-generator_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/free-tiktok-followers-without-human-verification_GM835599320.pdf
    • http://opac.akafarma-aceh.ac.id/repository/how-to-get-minecraft-windows-10-for-free-2021_GM479516143.pdf
    • http://opac.akafarma-aceh.ac.id/repository/roblox-cheat-god-mode_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/mcpe-master-hack-coin-apk_GM406889139.pdf
    • http://opac.akafarma-aceh.ac.id/repository/free-robux-generator-2021-no-human-verification_GM431946152.pdf
    • http://opac.akafarma-aceh.ac.id/repository/free-daily-spins-coin-master_GM406889139.pdf
    • http://opac.akafarma-aceh.ac.id/repository/robux-giver_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002dce.bin
82639fcb94b4080759086c4b174288cc67b36caa93623d18edf9d171554372a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DCE 22244 bytes
font_01_sfnt_off00005f38.bin
04b1a1c77a6521d6ebb84930f6bf6c885a343970337e2995ddaa610a7793a2d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F38 19192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.