Malicious PDF — malware analysis report

Static analysis result for SHA-256 d90f8cc6382667cd…

MALICIOUS

PDF

34.0 KB Created: 2021-06-27 16:00:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 3b8778914735c98a2c01a24a18208d48 SHA-1: 22b622c4284b2fdc9b7f77d0f35884436d052feb SHA-256: d90f8cc6382667cda15d03b80ac0d21cecb1c78f55732ab784df91fd53d2f7f3
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous links to external resources, many of which are algorithmically generated and point to potentially malicious content related to game cheats and free items. The ML classifier strongly flagged this PDF as malicious, and the presence of a 'download button' heuristic further supports the intent to trick users into downloading further malware. The document body and embedded URLs suggest a lure for game-related exploits.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/veorra-set-free-roblox-i PDF link annotation
    • http://digilib.iailm.ac.id//repository/minecraft-pe-server-hosting-free_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/toolbox-for-minecraft-windows-10_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/free-robux-and-tix-for-roblox_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/coin-master-free-cards-link-2021_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/https-oprewards-com-roblox_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/how-to-get-free-things-in-roblox-catalog_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/minecraft-sign-up-free_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/minecraft-free-no-virus_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/how-to-get-free-robux-ad_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/coin-master-free-link-app_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/coin-master-hack-ios-jailbreak_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/free-minecraft-skins-girl_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/freespinandcoinblogspotcom-2021-11-coinmasterfreespinandcoinlinkshtml_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/coin-master-free-spin-link-today-50_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/free-robux-giveawaycom_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/minecraft-pe-free-apk_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/https-rbx-place-rewards_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/best-free-roblox-outfits_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/roblox-com-free-robux_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/coin-master-free-blogspot_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002dbc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2DBC 22408 bytes
SHA-256: 844fe3885e1c8b4a51d704b6c94134f6e5b7d3080ce98f7b6f71b057058c84e1
font_01_sfnt_off00005f7a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5F7A 19128 bytes
SHA-256: 59dc45467b12c60556d3b2fd4cd633701b1546d21cab719db2b9eda76a676f4b

Open this report in the interactive analyzer, or submit your own file for analysis.