Malicious PDF — malware analysis report

Static analysis result for SHA-256 d74c5f6d94714368…

MALICIOUS

PDF

50.5 KB Created: 2021-05-10 23:02:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 8338dc6cf02588ab33a3e6c9935a6957 SHA-1: 0649a5a0740757d15918bc75fd88d058f027d34d SHA-256: d74c5f6d947143685602855b01b44c79c1daaa830be35a4d67cf9d7525a731ee
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded links, identified as a link farm, pointing to websites that promise free Robux and game hacks. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs and a call-to-action phrase suggests a phishing or scam attempt. Although no scripts were explicitly extracted, the PDF structure and embedded links are indicative of malicious intent, likely leading to credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9977

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-gift-card-game-hack
    • http://uilis.unsyiah.ac.id/ebook/repository/robux-free-gift-card_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/how-to-hack-and-get-free-robux_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/rbx-place-free-robux_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/how-to-get-free-spins-on-coin-master-iphone_GM406889139.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/free-robux-no-verification-or-survey_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/coin-master-free-spins-and-coins-hack_GM406889139.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/giftrobux-com-generator_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/hack-to-protect-village-on-coin-master_GM406889139.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/coin-master-free-spins-activegamer_GM406889139.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/how-do-you-get-roblox-for-free_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/114-4-hacks_GM479516143.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/free-bobux_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/google-how-do-you-get-robux_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/how-to-o-get-free-coin-master-spins_GM406889139.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/coin-master-mod-version-free-download-2021_GM406889139.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/coin-master-hack-spins-free_GM406889139.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/roblox-rape_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/free-robux-no-verification-no-download_GM431946152.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/coin-master-free-coins-and-spins-online-tool_GM406889139.pdf
    • http://uilis.unsyiah.ac.id/ebook/repository/coin-master-hack-no-survey-or-verification_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000048a6.bin
cb3e4764046848d7914a2f0facac6ab8dda5ce1181d5b34d8af0a295b7015f47		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x48A6 41248 bytes
font_01_sfnt_off0000a26f.bin
59f1432744b9d8cf879cb7c8a299bbbbba85d5427cd565107f85277265ec050e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA26F 18640 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.