Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe67d27dc0deeafc…

MALICIOUS

PDF

35.7 KB Created: 2021-07-05 15:39:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 6ec76b8e88c480b3ca24adfe6ab20d8c SHA-1: 5104ebd6983ed768dae71934aab42ef0db195e1f SHA-256: fe67d27dc0deeafc92ee7a43a55b2760ee3f9690624991218f51db7e1bb4f82e
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document contains numerous links that impersonate game hacks and generators, a common lure for phishing or malware distribution. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of such links, suggesting a malicious intent to redirect users. While no scripts were directly extracted, the embedded links and the nature of the lures strongly suggest the document is designed to lead users to malicious sites, likely for credential harvesting or further payload delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/roblox-inappropriate-games-game-hack PDF link annotation
    • http://chem.ipb.ac.id/kim/repository/free-coin-master-coins_GM406889139.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/websites-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/coin-master-get-free-spins_GM406889139.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/best-minecraft-hacked-client-2021_GM479516143.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/how-to-get-free-robux-no-inspect-2021_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/free-robux-only-username-no-human-verification_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/hack-coin-master-for-android_GM406889139.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/flame-gg-free-robux_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/today-on-roblox-we-will-be-hacking-scootch202156_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/tiktok-free-fans-cheat_GM835599320.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/pig-master-coin-master-free-spin_GM406889139.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/how-to-hack-a-minecraft-account_GM479516143.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/how-do-i-get-free-robux_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/free-minecraft-capes_GM479516143.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/no-human-verification-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/free-roblox-items-codes_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/minecraft-windows-10-free-with-java_GM479516143.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/free-robux-with-no-human-verification_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/roblox-its-free_GM431946152.pdfIn PDF document text
    • http://chem.ipb.ac.id/kim/repository/how-can-you-get-free-robux-on-your-phone_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003323.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3323 22692 bytes
SHA-256: 42914857810ddd43fb145f4c714377cf2bfbd283190d4279ec635d1611a63ec3
font_01_sfnt_off00006629.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6629 19144 bytes
SHA-256: 962ed03b51a907c483c3a4dabfb82cc9a3e866fb956ce5443609f5cba8a742c7

Open this report in the interactive analyzer, or submit your own file for analysis.