Malicious PDF — malware analysis report

Static analysis result for SHA-256 e995d95b318632ae…

MALICIOUS

PDF

43.9 KB Created: 2021-06-08 10:22:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-05
MD5: 3593d21534f87db02057b8e450fa10e2 SHA-1: b751b949379c419959b4501e5876ae718f4f8fee SHA-256: e995d95b318632aefeee2ccf188f25cd5f08ddc86a737200f24830a82c5f326f
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a high-severity heuristic firing for a 'GAME_HACK_REDIRECT_LURE' pointing to a URL associated with free game currency generators. The document body and embedded URLs reinforce this theme, suggesting a social engineering tactic to trick users into visiting malicious sites. While no scripts were directly extracted, the PDF structure and embedded links indicate a malicious workflow designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9963

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/robux-page-free-game-hack PDF link annotation
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/free-coin-coin-master_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/minecraft-marketplace-free_GM479516143.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/free-bling-bling-card-coin-master_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/free-rare-cards-for-coin-master-christmas_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/robux-generator-no-human-verification_GM431946152.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/get-free-robux-without-human-verification_GM431946152.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/free-robux-without-survey_GM431946152.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/coin-master-free-spin-link-today-2021_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/free-spins-for-coin-master-2021_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/coin-master-mod_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/roblox-hack-codes_GM431946152.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/roblox-install-free_GM431946152.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/roblox-free-robux_GM431946152.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/coin-master-hacks-for-gold-cards_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/coin-master-strategy_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/free-spins_GM406889139.pdfIn PDF document text
    • https://www.medlinerecruitment.com/uploaded_files/userfiles/files/free-robux-generator-no-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://192.168.0.99/%20%3Cp%3E%3Cp%3EHome%20Apps%205%20Ways%20to%20Get%20Free%20Robux%20In%20Roblox%20in%202021.%20Apps;%205%20Ways%20to%20Get%20Free%20Robux%20In%20Roblox%20in%202021.%20By.%20Maria%20Garcia%20-%20May%204,%202021.%200.%2019.%20Facebook.%20Twitter.%20Pinterest.%20WhatsApp.%20Amid%20Covid%20Crisis,%20Online%20gaming%20is%20one%20of%20the%20best%20ways%20to%20keep%20yourself%20entertained%20and%20busy%20while%20staying%20safe%20at%20home.%3Cp%3E%3Cp%3Efree%20robux%20thai%3Cp%3E%3Cp%3Eroblox%20games%20that%20allow%20free%20cam%3Cp%3E%3Cp%3Efree%20download%20gui%20roblox%20twisted%20murder%3Cp%3E%3Cp%3Efree%20roblox%20scripts%20for%20studio%3Cp%3E%3Cp%3Ehow%20to%20get%20free%20robux%20legit%20august%2020%3Cp%3E%3Cp%3ESUBSCRIBE!Totally%20not%20click%20bait!%20I%20am%20going%20to%20discuss%20hacking,%20exploits,%20scripting,%20and%20how%20to%20prevent%20them.%20This%20is%20an%20explination%20of%20how%20the%20exploits...%3Cp%3E%3Cp%3Efree%20pants%20in%20roblox%3Cp%3E%3Cp%3EYeojin%20is%20the%20maknae.%20First%20steps%20camps%20ages3%20roblox%20cute%20girl%20outfits%20free%205%20100%20300pm.%20Free%20Free%20Cute%20Girl%20hacki%20do%20robloxa%20cs%20go%20Outfit%20Roblox.%20Free%20free%20cute%20girl%20outfit.%20Roblox%20news%20gui.%20Play%20games%20like%20turkey%20hunt%20over%20the%20river%20hack%20in%20roblox%20download%20turkey%20run%20and%20turkey%20pardon.%3Cp%3E%3Cp%3Ecomo%20hackear%20dragon%20ball%20fury%20roblox%3Cp%3E%3Cp%3ERoblox%20Zerov2%20Free%20Trial%20120%20Commands%20Lumber%20Tycoon%202%20Phantom%20Wood.%20Roblox%20zerov2%20free%20trial%20120%20commands%20lumber%20tycoon%202%20phantom%20wood%20free%20on%20the%20cheap.%20Chity%20Dlya%20Roblox%20Lumber%20Tycoon%202%20Peatix.%3Cp%3E%3Cp%3Efree%20vip%20for%20roblox%20free%20video%20star%20egg%3Cp%3E%3Cp%3EWhat%20is%20Free%20Robux%20Generator?%20Now%20that%20you%20know%20how%20important%20Robux%20is,%20we%20are%20sure%20that%20you%20would%20want%20to%20know%20how%20to%20create%20these%20Robux%20in%20the%20first%20We%20have%20a%20Robux%20generator%20where%2In PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000053ee.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x53EE 24040 bytes
SHA-256: 7073f85f843f9a9000fb228ade85a272786af942a415dc26b17532cdfee61817
font_01_sfnt_off00008aa5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8AA5 17916 bytes
SHA-256: afbe6aa14516940f64b99f9950103b5fe3f20cf76704f0274dced73448fe9b8f

Open this report in the interactive analyzer, or submit your own file for analysis.