Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e5d005fd6df983e…

MALICIOUS

PDF

47.1 KB Created: 2021-06-03 09:19:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 2388fdc54d2a9125b15bc3106e474172 SHA-1: 7f49052152b627af003292d055f67933c6c48efa SHA-256: 0e5d005fd6df983e0a59f98baac396e0c94f62331149f5e0988885049470820a
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document exhibits characteristics of an advance-fee scam, using lures related to free in-game currency like 'Robux' to entice users. It contains multiple embedded URLs pointing to external resources, likely hosting malicious payloads. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9769

Heuristics 4

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/free-robux-on-phone-game-hack
    • http://oca.undil.tl/repository/how-to-get-more-robux-for-free_GM431946152.pdf
    • http://oca.undil.tl/repository/coin-master-hack-spins-and-coins-unlimited-free_GM406889139.pdf
    • http://oca.undil.tl/repository/how-to-get-free-robux-youtube_GM431946152.pdf
    • http://oca.undil.tl/repository/coin-master-hack-apk-35-8_GM406889139.pdf
    • http://oca.undil.tl/repository/how-to-get-free-robux-for-kids_GM431946152.pdf
    • http://oca.undil.tl/repository/free-executor-roblox_GM431946152.pdf
    • http://oca.undil.tl/repository/roblox-redeem_GM431946152.pdf
    • http://oca.undil.tl/repository/robloxfun-com-generator_GM431946152.pdf
    • http://oca.undil.tl/repository/how-to-get-free-robux-easy-2021_GM431946152.pdf
    • http://oca.undil.tl/repository/free-coin-master-coins-and-spins_GM406889139.pdf
    • http://oca.undil.tl/repository/free-roblox-injector_GM431946152.pdf
    • http://oca.undil.tl/repository/apps-that-give-you-free-robux_GM431946152.pdf
    • http://oca.undil.tl/repository/free-coinmaster-spins_GM406889139.pdf
    • http://oca.undil.tl/repository/get-free-spins-on-coin-master_GM406889139.pdf
    • http://oca.undil.tl/repository/moon-static-coin-master-generator-hacks-free_GM406889139.pdf
    • http://oca.undil.tl/repository/minecraft-free-ios_GM479516143.pdf
    • http://oca.undil.tl/repository/roblox-verification_GM431946152.pdf
    • http://oca.undil.tl/repository/coin-master-spin-free_GM406889139.pdf
    • http://oca.undil.tl/repository/coin-master-spin-hack_GM406889139.pdf
    • http://oca.undil.tl/repository/coin-master-100-spin_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000505c.bin
98a6b3068a255c994b8c09881b3c38bd04e5a947e22d12799a8b5a3a4270f1cf		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x505C 25656 bytes
font_01_sfnt_off00008be6.bin
34dd21cbcbbf8680f9624d5ddfa25e49232e6768200f74ddacb5347fd7a5f6dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BE6 2820 bytes
font_02_sfnt_off00009586.bin
a8c9403bd24fc6ffbb74b72c8864e8746fc5e9ab0f3a7e731dec7195ce2a3638		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9586 18332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.