Malicious PDF — malware analysis report

Static analysis result for SHA-256 d96a35e08e23ae9a…

MALICIOUS

PDF

48.3 KB Created: 2021-06-10 23:39:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 0df50c96f34e587dfe7efc9ecea2dc69 SHA-1: 3a8bdbb71e5d0ef50c5ea5782a8ac7dba5bcd66a SHA-256: d96a35e08e23ae9aee9435f666ae9bb1244920b0e3c827e780fa48ec36c59723
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains numerous embedded links, many of which are part of a link farm designed to appear as legitimate resources for games like Roblox and Coin Master. The primary external URI, 'https://netcdn.tw/app/431946152/uirbx.club-roblox-roblox-hack-game-hack', suggests a lure for users seeking game hacks, likely to distribute malware. The ML classifier strongly indicated maliciousness, and the presence of embedded links and a 'download button' heuristic further supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/uirbx.club-roblox-roblox-hack-game-hack
    • http://digilib.ulm.ac.id/pusat/repository/coin-master-free-coins-and-spins-2021_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/coin-master-heaven-free-spins-and-coins_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/minecraft-free-download-mac-full-version_GM479516143.pdf
    • http://digilib.ulm.ac.id/pusat/repository/coin-master-daily-gift-free-spins-and-coins-link_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/coin-master-pro-hack_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/get-free-robux-today_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/free-roblox-accounts-with-robux-that-work-not-banned-2021_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/free-mods-for-coin-master_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/www-free-robux_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-do-i-get-free-robux_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-to-get-free-robux-gift-cards_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/coin-master-hack-8-ball-pool_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/robloxheroxyz-free-robux_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/safe-hack-for-coin-master-android_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/static-moonactive-net-free-spins-coin-master_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/minecraft-windows-10-free-code_GM479516143.pdf
    • http://digilib.ulm.ac.id/pusat/repository/coin-master-mod_GM406889139.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-to-get-free-mods-in-minecraft_GM479516143.pdf
    • http://digilib.ulm.ac.id/pusat/repository/how-to-get-free-robux-without-downloading-anything_GM431946152.pdf
    • http://digilib.ulm.ac.id/pusat/repository/free-roblox-outfits_GM431946152.pdf
    • https://www.roblox.co
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000509e.bin
3b9c8be57231d21e6f197822409c5394ca7e7c39286b9c4406556aa83e4ab31c		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x509E 28160 bytes
font_01_sfnt_off00008f52.bin
94c1b019735d7e491765340abe50b2897410e2ec65ecf141c08bd9f2220897c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8F52 2824 bytes
font_02_sfnt_off00009900.bin
bea8dc4057dbb3730ae0c615e23bd86edb077216bb2a1f681d7dbcd4e339bee8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9900 18696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.