Malicious PDF — malware analysis report

Static analysis result for SHA-256 d8cdc1849e78b6ca…

MALICIOUS

PDF

32.2 KB Created: 2021-04-03 19:52:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-07-13
MD5: 595e66eb23ebebdcbd29ff2a97b34853 SHA-1: f9a257e7848fd462f086960a84c69651ed822038 SHA-256: d8cdc1849e78b6cae491e525d21e8cd3de057c3d256c35213bc1fa813f51068d
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, identified by the PDF_GAME_HACK_SEO_LINK_FARM heuristic, that lead to websites promising game hacks and free virtual currency. These URLs are likely part of a scam to generate ad revenue or phish users. While no scripts were explicitly extracted, the nature of the content and the ML classifier output strongly suggest malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9735

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/game-roblox-free-online PDF link annotation
    • https://gomsa.nl/images/farm-life-roblox-cheat.pdf%0AIn PDF document text
    • https://estalagemmonteverde.com.br/images/roblox-redline-hack.pdf%0AIn PDF document text
    • https://www.audev.com/images/google-how-do-you-get-free-robux.pdf%0AIn PDF document text
    • http://svp-steinmaur.ch/images/roblox-bot-free.pdf%0AIn PDF document text
    • https://technospektr.com.ua/images/how-to-get-free-robux-free-codes.pdf%0AIn PDF document text
    • https://corbo.ru/images/roblox-hack-me-free-robux.pdf%0AIn PDF document text
    • http://www.lionel-seppoloni.fr/images/how-to-get-free-headphones-on-roblox-2021.pdf%0AIn PDF document text
    • https://www.porthos.it/images/chicago-2021-free-model-roblox.pdf%0AIn PDF document text
    • https://www.wildpark-johannismuehle.de/images/how-do-you-get-free-cars-in-roblox-vehicle-simulatert.pdf%0AIn PDF document text
    • https://consorziocsa-asicaivano.it/images/was-roblox-hacked-once.pdf%0AIn PDF document text
    • https://www.utalii.ac.ke/images/how-to-get-5-robux-for-free-2021.pdf%0AIn PDF document text
    • http://uptodate.az/images/how-to-use-nexus-to-hack-in-roblox-royale-high.pdf%0AIn PDF document text
    • https://www.porthos.it/images/free-robux-for-samsung.pdf%0AIn PDF document text
    • https://www.tsdb.com.au/images/rbx-free-roblox.pdf%0AIn PDF document text
    • http://www.remiauclair.fr/images/robloxgamehackonline-verification-problem.pdf%0AIn PDF document text
    • http://kids-academy.pl/images/free-hair-roblox-not-model-or-decal.pdf%0AIn PDF document text
    • http://www.nielsen2u.dk/images/how-to-get-free-robux-on-a-laptop-2021.pdf%0AIn PDF document text
    • http://www.drent.se/images/exos-cheat-roblox.pdf%0AIn PDF document text
    • http://escolaarboc.cat/images/roblox-robux-hack-generato.pdf%0AIn PDF document text
    • http://salantiskis.lt/images/roblox-hack-get-unlimited-robux-november-2021.pdf%0AIn PDF document text
    • http://hemmet-strand.dk/images/win-free-robux-robux-robux-free-new-game-order-roblox.pdf%0AIn PDF document text
    • https://www.eglihotel.gr/images/free-knife-cbro-roblox.pdf%0AIn PDF document text
    • http://www.agri-tech.com.au/images/roblox-4all-cool-roblox-hack.pdf%0AIn PDF document text
    • http://chartsmart.com.au/images/how-to-get-free-robux-without-having-to-download-anything.pdf%0AIn PDF document text
    • http://aeroclub-kaernten.at/images/comment-hacker-roblox-sans-logiciel-youtube.pdf%0AIn PDF document text
    • https://www.eglihotel.gr/images/roblox-cheats-2021-robux.pdf%0AIn PDF document text
    • https://www.beaufortcollege.ie/images/free-robux-2021-april.pdf%0AIn PDF document text
    • http://www.exikom.com.ua/images/how-to-get-free-robux-working-2021-phone-easy.pdf%0AIn PDF document text
    • http://escolaarboc.cat/images/free-robux-without-survey.pdf%0AIn PDF document text
    • http://iluvlocalplaces.com/images/hack-roblox-apocalypse-rising-2021.pdf%0AIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (font_00_sfnt_off000033a7.bin)
🗂 Part of campaign: escolaarboc.cat 3 samples

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33A7 18988 bytes
SHA-256: 66027bb0252177770cd88b4ac24d0ee9052d8562a8316496d119b741c3874625
font_01_sfnt_off00005b35.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B35 17952 bytes
SHA-256: 32f21602adfb30dcabb52a49ce17e7cb3a363a08c6708650776294f64dbd81bc