Malicious PDF — malware analysis report

Static analysis result for SHA-256 f98f05fe3abc1224…

MALICIOUS

PDF

34.1 KB Created: 2021-06-28 03:50:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-07
MD5: 4e388b8347548b362e53464d098c0354 SHA-1: 903d42208e39d48d07661cd5430fd2c8ec6ac146 SHA-256: f98f05fe3abc1224913dfcc9787e38728a124dc12e6ba46993ae2d5a22365953
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document uses a lure of 'Free Robux' to entice users to click on embedded links, such as http://netcdn.co/app/431946152/free-robux-no-scam-or-password-game-hack. This behavior is consistent with phishing or malware distribution campaigns, likely aiming to trick users into downloading further malicious content or visiting scam websites. The ML classifier strongly supports the malicious nature of this PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-robux-no-scam-or-password-game-hack PDF link annotation
    • http://perpustakaan.bundadelimalampung.ac.id/repository/roblox-hack-attack-wiki_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/free-robux-inspect-hack_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/hack-account-roblox-2021-edit-this-cookies_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/coin-master-card-collection-hack_GM406889139.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/roblox-games-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/roblox-shirt-for-kids-free-shipping_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/roblox-controversy_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/2021-no-human-verification-hack-for-coin-master_GM406889139.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/xyz-roblox-hack-download-2021_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/how-to-play-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/red-kine-cheat-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/fb-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/free-robux-no-verification-2021-android_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/free-roblox-hack-us_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/coin-master-free-spins-gratis_GM406889139.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/how-to-get-free-robux-2021-ios_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/mcpe-com_GM479516143.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/how-to-get-free-unlimited-robux-in-roblox-youtube_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/get-me-free-robux_GM431946152.pdfIn PDF document text
    • http://perpustakaan.bundadelimalampung.ac.id/repository/minecraft-bedrock-edition-pc-free_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f60.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F60 21748 bytes
SHA-256: 592ef1af8da54322f050f5307e60e8e526032c7c631c9c7ed9b89f85d45a4562
font_01_sfnt_off00005ee3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5EE3 19468 bytes
SHA-256: f49b3193eb5b1aac8e1e0101f390b3111af67d17a1195b87f37412392d358c09

Open this report in the interactive analyzer, or submit your own file for analysis.