Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdd9d5ef78807d30…

MALICIOUS

PDF

49.7 KB Created: 2021-06-09 13:16:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 52a2bc01fb06ed586890b5215102c0f6 SHA-1: a2e6ced19642c2392d443bfb2b8d8089e068e229 SHA-256: fdd9d5ef78807d30229b546db929046408a8273fc05e662cc48278e0802c4581
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains a large number of external links, many of which are related to game cheats and hacks. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, and the 'ML_NYX_PDF_MALICIOUS' model strongly suggests malicious intent. The document body, though partially corrupted, contains URLs that likely lead to malicious content or phishing pages, aiming to trick users into downloading malware or revealing sensitive information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9751

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/835599320/free-likes-for-tiktok-game-hack
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-2021_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-golden-card-in-coin-master_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/who-to-hack-pubg-uc_GM1330123889.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-free-coins-link-2021-deutsch_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/roblox-exploit-scripts_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-free-spins-activegamer_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux-hack-2021_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-roblox-accounts-dantdm_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-invite-friends-hack_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-make-a-free-minecraft-account_GM479516143.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-hack-tool-for-pc_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/carding-for-pubg-uc_GM1330123889.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/robux-generators-that-actually-work_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-get-minecraft-for-free-on-tablet_GM479516143.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-play-coin-master_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/25-free-spins-coin-master_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/how-to-hack-roblox-passwords_GM431946152.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/coin-master-hacks_GM406889139.pdf
    • https://pendapatan.denpasarkota.go.id/new/public/ckfinder/userfiles/files/free-tiktok-fans-app_GM835599320.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005094.bin
d76ce59ef4c17d7b9f87bc240115c7faaa10c7c379c98d003864a59422cfca3f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5094 24928 bytes
font_01_sfnt_off00008a3d.bin
3ee6bff20bd826c6e6537a0bc849c1bc3db0446dfe99ff579e722294b305b661		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A3D 3644 bytes
font_02_sfnt_off000096b9.bin
49734f51977507cba6bc8d3ad0cee0363aa119856db094427deb9cf565bb7bca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x96B9 3120 bytes
font_03_sfnt_off0000a1cc.bin
308920fe04ba02bee84e9df39862d70534e91875b9399095fdfb0b81d81483e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA1CC 17456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.