Malicious PDF — malware analysis report

Static analysis result for SHA-256 f0efc48a8c47bd88…

MALICIOUS

PDF

36.2 KB Created: 2021-07-05 18:40:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 035d7b18bd2177a0c41d07d8d926ec81 SHA-1: 5d908f1d792230f9b44ec1f8444b9fe2ffb61e46 SHA-256: f0efc48a8c47bd8850b8d04a96f3bb618bb2ad4c385561b86136f8e3481dea4e
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a large number of embedded links, many of which are related to obtaining free Robux or game hacks. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, and the ML classifier strongly flagged this PDF as malicious. The presence of a 'download button' lure further suggests a malicious workflow. The primary IOC is the domain 'netcdn.tw' which hosts a URL directly referencing 'free-robux-game-hack'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/websites-that-give-you-free-robux-game-hack
    • http://library.unissula.ac.id/fk/repository/car-sim-free-car-roblox_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/how-to-bypass-cheat-engine-on-roblox_GM431946152.pdf
    • http://library.unissula.ac.id/fk//repository/free-robux-no-gift-card_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/roblox-free-robux-redeem-code_GM431946152.pdf
    • http://library.unissula.ac.id/fe/repository/hack-roblox-galaxy-itan_GM431946152.pdf
    • http://library.unissula.ac.id/fk//repository/coin-master-free-spins-and-coins-link-today_GM406889139.pdf
    • http://library.unissula.ac.id/fk/repository/how-to-get-free-robux-with-the-nopde-cheat-engine_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/google-how-do-we-get-free-robux_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/how-to-use-python-for-hacking-roblox_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/how-to-make-things-free-on-roblox_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/free-robux-without-human-verification-on-ipad_GM431946152.pdf
    • http://library.unissula.ac.id/fe/repository/tiktok-free-verified_GM835599320.pdf
    • http://library.unissula.ac.id/fk/repository/cheat-roblox-superpower-training-simulator-2021_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/i-want-robux_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/generate-robux-for-free-with-no-downloading-games_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/free-robux-gift-card-codes-2021-july_GM431946152.pdf
    • http://library.unissula.ac.id/fk/repository/free-robux-gift-card-codes-2021_GM431946152.pdf
    • http://library.unissula.ac.id/fe/repository/minecraft-bedrock-edition-pc-download-free_GM479516143.pdf
    • http://library.unissula.ac.id/fk//repository/tiktok-free-hong-kong_GM835599320.pdf
    • http://library.unissula.ac.id/fk//repository/coin-master-fan-page-facebook_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003220.bin
ad395c30c270ac9a07e0ef2bd8d46db0acbdbf931ce2d8be04f93666dee6785a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3220 23356 bytes
font_01_sfnt_off00006714.bin
7292eb3338cb6c9d3aaa3bb5f0b07597ff2ce37f19197e11b99fdf35000b820a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6714 19580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.