Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd5e8d7f166975af…

MALICIOUS

PDF

35.4 KB Created: 2021-06-28 23:42:35 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 77a00ce289beb78100c4c97d6fd071a6 SHA-1: 5bfc80756ab08a155c2518d9b1323c0f6dece615 SHA-256: fd5e8d7f166975afc323d509ff9d10999bbc82813b2cacbb604f6d12ad7c2a20
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document exhibits characteristics of a malicious lure, employing a fake CAPTCHA or human verification prompt to deceive users. It contains a large number of external links, many of which are related to hacking or obtaining free in-game currency for popular games like Roblox and TikTok. The primary goal appears to be directing users to potentially malicious websites or facilitating downloads of unwanted software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake CAPTCHA / human verification prompt high SE_FAKE_CAPTCHA
    Document displays a fake CAPTCHA or human-verification prompt — used to trick users into running commands or pressing keyboard shortcuts
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-hack-a-roblox-account-to-show-people-game-hack
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/roblox-jailbreak-auto-rob-hack_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-tiktok-likes-no-human-verification-or-downloading-apps_GM835599320.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/growbux-free-robux-app_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/how-to-change-your-face-on-roblox-for-free_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/roblox-free-not-to-download_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/roblox-badges-hack_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/descargar-roblox-hackeado-para-android-2021_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/exploit-roblox-hack-download_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-robux-with-no-verification_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/hacking-roblox-accounts-cheat-engine_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/roblox-card-free-fake-it_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-robux-pins-2021_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-coin-master-coins-and-spins_GM406889139.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/cheat-codes-for-dayz-roblox_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/free-roblox-griups_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/give-me-free-robux-com_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/100-free-spins-coin-master_GM406889139.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/coin-master-hack-https-coinms-net_GM406889139.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/how-to-join-someones-game-on-roblox-without-hacks-codes_GM431946152.pdf
    • http://e-learning.mtsn15ciamis.sch.id/__statics/gudangsoal/files/how-to-hack-on-roblox-and-get-the-comands_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003358.bin
38b55e33efed92b34a7ccb4b872e8f15767a133a9ed31db22c5fadca0e745634		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3358 22196 bytes
font_01_sfnt_off000063fa.bin
19afb8e8e37ce0dd20a6385fc6e9d9ad2b2f46817297bbebb0bcd086b9db6a85		 pdf-font-stream PDF embedded font (sfnt) at offset 0x63FA 19560 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.