Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd0cd1d74a2cc445…

MALICIOUS

PDF

44.3 KB Created: 2021-05-16 04:42:08 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 7d604271a10aeebe8aa774767234cb04 SHA-1: e90a9623f56209e2106dacbb7e96902f003adf3d SHA-256: fd0cd1d74a2cc44518a38006d1752accfde7ab0772084749b3a8fe3f540a2555
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs and a link farm heuristic indicates a large number of external links, suggesting a SEO spam or phishing campaign. The document body, though partially corrupted, contains references to 'Coin Master Codes' and 'game hack', aligning with the external URLs. The presence of external links and the ML classifier's high confidence score support a malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9648

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/coin-master-codes-game-hack
    • http://centr-expert.su/images/free-spins-coin-master-october-17-2021_GM406889139.pdf
    • http://centr-expert.su/images/free-roblox-hack-us_GM431946152.pdf
    • http://centr-expert.su/images/free-coins-for-coin-master_GM406889139.pdf
    • http://centr-expert.su/images/daily-free-spins-and-coins-coin-master_GM406889139.pdf
    • http://centr-expert.su/images/minecraft-bedrock-free-with-java_GM479516143.pdf
    • http://centr-expert.su/images/how-to-hack-someones-minecraft-account_GM479516143.pdf
    • http://centr-expert.su/images/minecraft-bedrock-hacks_GM479516143.pdf
    • http://centr-expert.su/images/daily-free-spin-link-for-coin-master_GM406889139.pdf
    • http://centr-expert.su/images/free-robux-generator-no-survey_GM431946152.pdf
    • http://centr-expert.su/images/rbx-hut_GM431946152.pdf
    • http://centr-expert.su/images/pasos-para-hackear-coins-master_GM406889139.pdf
    • http://centr-expert.su/images/rbxfree-com-free-robux_GM431946152.pdf
    • http://centr-expert.su/images/coin-master-unlimited-spin-link_GM406889139.pdf
    • http://centr-expert.su/images/coin-master-free-spins-and-coins-2021_GM406889139.pdf
    • http://centr-expert.su/images/minecraft-handbook_GM479516143.pdf
    • http://centr-expert.su/images/free-robux-codes-no-verification-2021_GM431946152.pdf
    • http://centr-expert.su/images/how-to-get-free-robux_GM431946152.pdf
    • http://centr-expert.su/images/master-coin-free-spin_GM406889139.pdf
    • http://centr-expert.su/images/free-roblox-gift-card_GM431946152.pdf
    • http://centr-expert.su/images/what-is-exploiting-in-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004722.bin
3ca9e49863fd5629071e73837d986e6e1c0009b585c34fa72f8ae4d3bf9ad882
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4722 25964 bytes
font_01_sfnt_off00008261.bin
3fb127b764b9d10f5525bc4de5ec8316de704409ccb0cf21cff3ad8a30d11676
pdf-font-stream PDF embedded font (sfnt) at offset 0x8261 2840 bytes
font_02_sfnt_off00008c13.bin
e3dc30cd69473f08b9483bb660e9aeaccc8f6f74c3e4f353697525059d592d8d
pdf-font-stream PDF embedded font (sfnt) at offset 0x8C13 17720 bytes