Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8d00d917761fdfd…

MALICIOUS

PDF

41.7 KB Created: 2021-04-03 14:19:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24
MD5: f209c0ea9a4a43a76f2982c688672a3c SHA-1: 9eeeb4c5c231b050ad35013e64e74ad721313143 SHA-256: f8d00d917761fdfd530bebc95f82b470e9851e4c43941ba9c3afa132b8b87007
132 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded URLs, many of which are associated with game hacks and free Robux scams. The heuristic PDF_GAME_HACK_SEO_LINK_FARM specifically identifies this as a link farm designed to lure users to scam websites. The ML classifier also flagged the PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9284

Heuristics 5

  • PDF carries distributed game-hack scam link farm critical PDF_GAME_HACK_SEO_LINK_FARM
    PDF contains a free-generator/game-hack lure together with many external PDF links spread across distinct hosts whose filenames advertise game hacks, cheats, jailbreaks, generators, or free currency. This is a high-confidence scam/SEO-poisoning carrier: the PDF exists to route users into malicious or unwanted download/redirect chains, not to present normal document content.
  • PDF carries game-hack generator link farm medium PDF_GAME_HACK_LINK_FARM
    PDF contains a gaminggenerator.org app lure together with multiple external PDF links whose filenames advertise game hacks, cheats, jailbreaks, or generators. This is a lure/delivery link farm rather than a PDF exploit: the risk is the linked redirection chain.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gaminggenerator.org/app/431946152/250k--robux-free PDF link annotation
    • http://salantiskis.lt/images/how-to-speedhack-roblox-without-cheat-engine.pdfIn PDF document text
    • http://www.agri-tech.com.au/images/free-robux-giving-group.pdfIn PDF document text
    • http://www.awakeningtruth.org/images/codes-for-free-stuff-ib-roblox.pdfIn PDF document text
    • https://www.udivadlahotel.cz/images/how-to-get-free-robux-on-phone-no-download.pdfIn PDF document text
    • http://dos.most.gov.la/images/roblox-how-to-hack-ro-get-free-robux-no-scam.pdfIn PDF document text
    • http://learningarabic.co.uk/images/robuxian-free-robux-code-generator.pdfIn PDF document text
    • http://agrao.in/images/roblox-hack-account-2021.pdfIn PDF document text
    • https://jdlgroup.ca/images/roblox-phantom-forces-cheats-aimbot.pdfIn PDF document text
    • https://kimolos-link.gr/images/free-robux-no-survey-no-download-no-human-verification-2021.pdfIn PDF document text
    • http://www.eurosan1.ba/images/roblox-hack-bugmenot.pdfIn PDF document text
    • https://www.air-shop.cz/images/i-dont-feel-so-good-sim-hack-roblox.pdfIn PDF document text
    • https://www.elevage-chiot.fr/images/roblox-free-robux-no-download.pdfIn PDF document text
    • https://socialvalue.gr/images/roblox-speed-hack-without-cheat-engine.pdfIn PDF document text
    • https://tokunfome.com.br/images/how-to-get-free-robux-apple.pdfIn PDF document text
    • http://www.drent.se/images/free-redem-code-list-roblox.pdfIn PDF document text
    • http://www.brtes.com/images/roblox-free-promo-codes-2021.pdfIn PDF document text
    • https://www.cpnf.ch/images/roblox-pin-hack.pdfIn PDF document text
    • http://www.copoint.co.uk/images/blockland-free-robux.pdfIn PDF document text
    • https://www.lavigny.ch/images/how-to-hack-peoples-account-on-roblox.pdfIn PDF document text
    • http://www.eurosan1.ba/images/cch-hack-m-pin-roblox.pdfIn PDF document text
    • http://gops.pruszczgdanski.pl/images/free-draw-2-roblox-save.pdfIn PDF document text
    • http://www.kalaaliaraq.dk/images/huskey-how-to-hack-any-roblox-account.pdfIn PDF document text
    • https://www.tsdb.com.au/images/comment-savoir-si-quelquun-hack-votre-compte-roblox.pdfIn PDF document text
    • http://aeroclub-kaernten.at/images/how-to-get-a-hacked-account-on-roblox-back.pdfIn PDF document text
    • http://nevesomost.by/images/free-roblox-members-for-groups.pdfIn PDF document text
    • https://amatq.ca/images/roblox-cheats-for-robux-with-inspect.pdfIn PDF document text
    • https://estalagemmonteverde.com.br/images/roblox-jailbreak-keycard-hack.pdfIn PDF document text
    • http://bilhetim.com.br/images/cheat-roblox-autocloc.pdfIn PDF document text
    • http://www.visiblefilm.com/images/free-models-rides-roblox.pdfIn PDF document text
    • http://www.remiauclair.fr/images/free-robux-site-youtube.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn extracted file (stream_003_off000041aa.bin)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000041aa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x41AA 23004 bytes
SHA-256: ab90b4c4d638945504069e8e1dbbfddba0d34a9462622fa8f3667f45e3474c49
font_01_sfnt_off00007410.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7410 3884 bytes
SHA-256: 40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf
font_02_sfnt_off000080b7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x80B7 17848 bytes
SHA-256: 4cd91fe1ed030dcffc8ff5ab65cb9491270d18ad060b87b7583ffa311992c82b