Malicious PDF — malware analysis report

Static analysis result for SHA-256 f77fd3333fe40497…

MALICIOUS

PDF

34.5 KB Created: 2021-06-18 04:58:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: e1e5377c0f207a34701aed38624f2718 SHA-1: 2ba0c28fa81d8dcf5981aacc5435b302c91311a3 SHA-256: f77fd3333fe404979649c037867666a23b18e00d794a9a15d567e734478697c1
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous embedded URLs and a "download button" lure, indicating an attempt to trick the user into downloading a malicious file. The ML classifier and PDF link farm heuristic strongly suggest malicious intent, likely to deliver a second-stage payload. The document body and extracted URLs point towards a scam related to game hacks and cheats.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-dragon-ball-final-hack-game-hack
    • http://shiny-nn.ru/images/how-to-enable-the-free-models-searcher-in-roblox-studiuo_GM431946152.pdf
    • http://shiny-nn.ru/images/hack-coin-master-apk-download_GM406889139.pdf
    • http://shiny-nn.ru/images/ultimate-free-spins-coin-master_GM406889139.pdf
    • http://shiny-nn.ru/images/free-robux-that-actually-works-2021_GM431946152.pdf
    • http://shiny-nn.ru/images/hack-coin-master-xyz_GM406889139.pdf
    • http://shiny-nn.ru/images/how-to-get-free-catalog-items-on-roblox-2021_GM431946152.pdf
    • http://shiny-nn.ru/images/free-bundles-in-roblox_GM431946152.pdf
    • http://shiny-nn.ru/images/free-roblox-promo-codes-for-robux_GM431946152.pdf
    • http://shiny-nn.ru/images/microsoft-roblox-rewards_GM431946152.pdf
    • http://shiny-nn.ru/images/coin-master-hack-online-download_GM406889139.pdf
    • http://shiny-nn.ru/images/free-coin-coin-master_GM406889139.pdf
    • http://shiny-nn.ru/images/como-conseguir-robux-hack-2021_GM431946152.pdf
    • http://shiny-nn.ru/images/how-to-earn-robux-for-free-2021_GM431946152.pdf
    • http://shiny-nn.ru/images/como-ganar-robux-gratis-sin-hacks_GM431946152.pdf
    • http://shiny-nn.ru/images/how-to-get-free-outfits-on-roblox_GM431946152.pdf
    • http://shiny-nn.ru/images/linkmon99-free-robux_GM431946152.pdf
    • http://shiny-nn.ru/images/free-robux-reddit_GM431946152.pdf
    • http://shiny-nn.ru/images/a-good-free-outfit-on-roblox_GM431946152.pdf
    • http://shiny-nn.ru/images/roblox-dominus-free_GM431946152.pdf
    • http://shiny-nn.ru/images/how-to-get-minecraft-for-free-2021_GM479516143.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030c2.bin
571d129d1cffc05aff653d6e7d2bdf06e6cc48106616e8629a27a25305fc1b90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30C2 22276 bytes
font_01_sfnt_off00006239.bin
d77d140b14ce1dc5b9de0590d984cd5e0e10ca19adaec66af4b6f1b13c8d6467		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6239 18924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.