PDF malware analysis — malicious · 0b2e2088fe398235

MALICIOUS

PDF

35.2 KB Created: 2021-06-29 03:36:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 85faa093c4eb6414153989039bd26e55 SHA-1: 71278fa27fc23d6c1f0aac8e26914e76f9fe24b3 SHA-256: 0b2e2088fe3982356ab8c6965ffdbabc42e532818bf14362fd2eb9308da64003

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document contains multiple embedded URLs and a prominent external URI pointing to sites offering game hacks and free in-game currency, indicating a phishing or malware distribution lure. The presence of a visual download button and callback lure heuristics further supports a malicious intent to trick users into downloading or interacting with malicious content. No scripts were extracted from this sample, but the overall pattern suggests a phishing attempt to deliver a second-stage payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/free-roblox-items-pastebin-game-hack
- https://metropolemoveis.com.br/ckfinder/userfiles/files/free-robux-gift-card-codes-800-robux_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/can-you-get-robux-for-free_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/free-robux-generator-2021-hack-no-survey_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/coin-master-hack-apk-download-2021_GM406889139.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/free-robux-picture_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/robux-free-gift-card-org-hack_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/mais-backpack-free-roblox_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/free-coins-and-spins_GM406889139.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/robux-free-promo-codes_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/free-spin-link-of-coin-master_GM406889139.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/minecraft-for-ipad-free_GM479516143.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/best-roblox-hacks_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/robux-hack_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/free-robux-hack-100-works-2021_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/programa-para-ser-hacker-en-roblox_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/roblox-cheat-engine-money_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/can-you-actually-get-free-robux_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/earn-robux-online-hack_GM431946152.pdf
- https://metropolemoveis.com.br/ckfinder/userfiles/files/how-to-get-minecraft-bedrock-for-free_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003126.bin` `787ebff96844af3b52e2e1d11c7ab15b1919a0846d956dcad686f6907b039ab8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3126	22712 bytes
`font_01_sfnt_off00006419.bin` `8f1f87d6c01877de3c399722d30396cb1c4cfbffb8e229b10aeeb915afe6155f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6419	19288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.