Malicious PDF — malware analysis report

Static analysis result for SHA-256 039b4f5bd68176dd…

MALICIOUS

PDF

36.7 KB Created: 2021-06-29 14:48:17 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 5f41ad53fb6ac5adfc489c69128a8498 SHA-1: b2696e904197b4ce2ec7a0c6a92083e8ffd72df2 SHA-256: 039b4f5bd68176dddf56f0e309bee569eb1364cdc36666b636cc2ba02644dbfe
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a prominent external URI pointing to 'free Robux' and 'free spins' lures, indicative of a phishing or scam attempt. The ML classifier strongly flagged this PDF as malicious, and the presence of these lures suggests an attempt to trick users into visiting malicious sites or downloading further malware. No scripts were extracted from this sample, but the overall pattern suggests a phishing lure designed to lead users to a malicious download or exploit.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-robux-glitch-december-2021-game-hack PDF link annotation
    • http://lib.fisipumt.ac.id//repository/free-online-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/free-robux-gift-card_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/what-is-exploiting-in-roblox_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/roblox-wifi-hack_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/coin-master-free-shield_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/coin-master-daily-free-spins-link-today_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-to-get-anything-on-roblox-catalog-for-free_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/roblox-gift-card-online-free_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-to-hack-roblox-accounts-on-phone-2021_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id//repository/coin-master-hack-online-2021_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/roblox-cheat-engine-hack-money_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-rs-roblox-2021_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/coin-master-hack-spin-ios_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/hack-the-coin-master_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-robux-no-human-verification-or-survey-seriously_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/friv-roblox-free_GM431946152.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/free-spin-link-for-coin-master-game_GM406889139.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/minecraft-free-online-unblocked_GM479516143.pdfIn PDF document text
    • http://lib.fisipumt.ac.id/repository/how-to-speed-hack-using-cheat-engine-roblox_GM431946152.pdfIn PDF document text
    • https://www.roblox.com/.IIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34D7 22756 bytes
SHA-256: 1fc53c462645f2ca8e374ef5390c3ab77c4562838a15ac05252dfb985cf6fd47
font_01_sfnt_off000067dd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x67DD 20008 bytes
SHA-256: cafb39fb85784338fcd3eb5d77f7b419eb2992782103f38296dc0906eb3a5232

Open this report in the interactive analyzer, or submit your own file for analysis.