Malicious PDF — malware analysis report

Static analysis result for SHA-256 03064ec5cd613261…

MALICIOUS

PDF

33.7 KB Created: 2021-06-29 11:49:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: a38202c6f29b575edd99b4a691436411 SHA-1: 9a5ee2bee7005583e3f84c24d5408506a29aa429 SHA-256: 03064ec5cd61326190a118db85befb17c546e99857f8135ad301cac1745ee1b8
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document presents itself as a "Free Roblox Mgui" hack, which is a common lure for malicious downloads. The presence of external URIs and the ML classifier flagging the PDF as malicious strongly indicate malicious intent. The document body contains numerous links to purported game hacks, suggesting the primary goal is to trick users into downloading malware from these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-mgui-game-hack
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/roblox-cartoon-animation-free_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/noob-vs-pro-vs-hacker-vs-god-roblox-booga-booga_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/roblox-badges-hack_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/how-to-hack-roblox-phantom_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/roblox-mobile-hack_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/free-robux-cheats-roblox_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/dragon-simulator-roblox-hack_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/roblox-speed-hack-2021-february_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/how-to-hack-roblox-robux-with-cmd_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/hack-to-get-20210-robux_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/roblox-synapse-free-download-2021_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/moonactive-coin-master-free-spins_GM406889139.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/minecraft-hack-download_GM479516143.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/wewgaming-hack-roblox_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/download-hack-in-roblox_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/how-to-get-free-robux-with-no-survey_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/roblox-new-code-for-free-sword_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/minecraft-hacker-skin_GM479516143.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/how-to-get-free-friendly-smile-for-real-pastebincom-roblox_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id/repository/roblox-free-robux-rewards_GM431946152.pdf
    • http://pustaka.biologi.fmipa.unand.ac.id
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ebc.bin
7ed7873a41597a963db1fa2c76eef3283fa031eb1e518c3f4727526957e6d232		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EBC 21760 bytes
font_01_sfnt_off00005eae.bin
f3dc7834da42d419cef941117514e173cc5a279ab01269e4a2a81499a3f6f4b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EAE 19104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.