Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5b6d1b9ee85e8c8…

MALICIOUS

PDF

34.6 KB Created: 2021-06-28 13:55:21 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-13
MD5: 9c5b1df0ad8d1d5f319644a0b56d85d6 SHA-1: 6b08124fe6b0dc69a9fe2ddf9924d740e0693af9 SHA-256: f5b6d1b9ee85e8c8e5e30ae5953f6639bc053b7ca2ea4f64dddb0844c71d9689
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded links, many of which are SEO-optimized to appear as legitimate downloads for game-related cheats and hacks. The primary URL, http://netcdn.co/app/431946152/free-roblox-beach-gfx-game-hack, suggests a direct attempt to deliver malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is designed to trick users into downloading harmful software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-beach-gfx-game-hack PDF link annotation
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/minecraft-bedrock-edition-pc-free_GM479516143.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/coin-master-free-spins-hack-2021_GM406889139.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/easy-how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/free-robux-no-survey-or-download-2021_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/how-do-you-get-free-robux-without-human-verification_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/minecraft-bedrock-edition-pc-download-free_GM479516143.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/coin-master-hack-apk_GM406889139.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/roblox-bee-swarm-simulator-cheats_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/how-to-know-if-hacked-on-roblox_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/free-gold-cards-for-coin-master_GM406889139.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/roblox-cheat-robux-generator_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/cheat-engine-closes-roblox_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/hack-roblox-counter-blox_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/coin-master-free-spons-apk-2021_GM406889139.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/roblox-com-hack_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/coin-master-hack-tips_GM406889139.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/how-to-get-free-money-in-roblox-jailbreak-on-ipad_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id/repository/account-hacked-roblox-reddit_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/free-robux-ad_GM431946152.pdfIn PDF document text
    • https://digilib-akuntansi.stkip-pgri-sumbar.ac.id//repository/how-to-get-a-free-minecraft-server_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003171.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3171 22264 bytes
SHA-256: b064f7afac4ec3fbaad73db49022811a3ab6c3e56fc3f5c689a52f203afb0da3
font_01_sfnt_off000062f7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62F7 18816 bytes
SHA-256: bccce5840b0eb53756c38548f4aff880ab2fffe77222e65bd0d7b4efa18148b1

Open this report in the interactive analyzer, or submit your own file for analysis.