Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbfb8795c6aaf4c0…

MALICIOUS

PDF

34.8 KB Created: 2021-07-06 04:23:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 14fc5a2e0713473b7dc9c61e7ba26378 SHA-1: 12a05a540e8333fed1baa5e6f1ccde5e2c0aabc0 SHA-256: dbfb8795c6aaf4c08297752acb384a5332080be5e2b803bd653f20ce3d69dd32
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links, identified as a link farm, that direct users to websites offering game hacks and cheats. The primary URL, http://netcdn.tw/app/406889139/coin-master-free-blogspot-game-hack, is a strong indicator of a malicious lure. While no scripts were directly extracted, the structure and heuristic firings suggest the document is designed to facilitate the download of malicious payloads by exploiting user interest in game cheats.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/coin-master-free-blogspot-game-hack
    • http://lib.stiesultanagung.ac.id/repository/roblox-can-you-teach-me-how-to-hack_GM431946152.pdf
    • http://lib.stiesultanagung.ac.id//repository/adopt-me-roblox-hacks_GM431946152.pdf
    • http://lib.stiesultanagung.ac.id/repository/free-account-roblox-with-robux_GM431946152.pdf
    • http://lib.stiesultanagung.ac.id//repository/how-to-get-minecraft-bedrock-edition-for-free_GM479516143.pdf
    • http://lib.stiesultanagung.ac.id/repository/coin-master-hack-no-survey-2021_GM406889139.pdf
    • http://lib.stiesultanagung.ac.id/repository/free-executor-download-for-roblox_GM431946152.pdf
    • http://lib.stiesultanagung.ac.id//repository/free-daily-spins-coin-master-2021_GM406889139.pdf
    • http://lib.stiesultanagung.ac.id/repository/robux-robuxian-awesome-hack_GM431946152.pdf
    • http://lib.stiesultanagung.ac.id//repository/pokemon-go-free-7km-egg-list_GM1094591345.pdf
    • http://lib.stiesultanagung.ac.id/repository/roblox-gift-card-online-free_GM431946152.pdf
    • http://lib.stiesultanagung.ac.id/repository/coin-master-online-hack-link_GM406889139.pdf
    • http://lib.stiesultanagung.ac.id/repository/coin-master-free-spin-codes_GM406889139.pdf
    • http://lib.stiesultanagung.ac.id/repository/coin-master-freebies_GM406889139.pdf
    • http://lib.stiesultanagung.ac.id/repository/how-to-get-free-spins-on-coin-master-hack_GM406889139.pdf
    • http://lib.stiesultanagung.ac.id/repository/minecraft-free-computer-game_GM479516143.pdf
    • http://lib.stiesultanagung.ac.id//repository/coin-master-free-spin-today_GM406889139.pdf
    • http://lib.stiesultanagung.ac.id/repository/master-coin-hack_GM406889139.pdf
    • http://lib.stiesultanagung.ac.id/repository/how-to-hack-into-other-peoples-roblox-accounts-2021_GM431946152.pdf
    • http://lib.stiesultanagung.ac.id/repository/anime-cross-2-roblox-hack_GM431946152.pdf
    • http://lib.stiesultanagung.ac.id/repository/free-robux-codes-no-human-verification_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003112.bin
e863f07b8a985c7077a804ff0d19d466f484dc1d568fba7e34f00381f0a2a4e3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3112 23064 bytes
font_01_sfnt_off00006516.bin
4ab065c9e1c1ce8cc0ca504291acf999189b22a872bad2ec3209c1b1ac2a7b96		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6516 18464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.