Malicious PDF — malware analysis report

Static analysis result for SHA-256 1280e760cafe8f91…

MALICIOUS

PDF

46.9 KB Created: 2021-06-02 02:46:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 104e3a7d614443723b97e9f7c04c7cb4 SHA-1: bbf32d374e121d6236b80c91726ddb2edf32e74d SHA-256: 1280e760cafe8f913eb4d2a5a9d971eabd8eee75ee33e6a33de65806f58a037c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple embedded URLs and a visual download lure, directing users to sites offering 'free Robux' or 'game hacks'. The ML classifier strongly flagged this PDF as malicious, indicating it likely serves as a dropper or phishing document. The presence of these links suggests an attempt to lead the user to download further malicious content or to a phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9769

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-shirts-for-free-game-hack
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/how-to-get-free-robux-on-roblox_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/minecraft-iphone-free_GM479516143.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/do-new-roblox-playe4e-get-robux-for-free_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/can-we-get-free-robux-in-roblox_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/how-to-hack-coins-in-reson-to-die-roblox_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/how-to-get-free-robux-2021-upatchable_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/roblox-hacking-admin-house_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/free-robux-without-verification_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/roblox-auto-clicker-free_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/roblox-hack-top-no-human-verification_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/robux-hack-cydia_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/descargar-roblox-hack_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/free-robux-no-human-verification-or-survey_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/tiktok-views-free_GM835599320.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/muscle-simulator-roblox-cheat_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/roblox-elemental-battlegrounds-hack-diamonds_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/how-to-hack-roblox_GM431946152.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/free-tiktok-followers-generator_GM835599320.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/minecraft-pe-free-download_GM479516143.pdf
    • https://bluemonkeydirect.com/wp-content/uploads/fsqm-files/coin-master-daily-free-spins-link_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005178.bin
7e49d55e27f35d49d3ba8fda76ed8765b348f986a44ea665951e94eb8822a7d3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5178 24016 bytes
font_01_sfnt_off000087a6.bin
40b61f8938bd710dc29dc58ba3fde91c245a6a69596ec569b4d27c769ca417cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87A6 3884 bytes
font_02_sfnt_off0000944e.bin
0e83256f30a52cac286c13b7f97a3bc01a1f8154bdd95c4af4e4a20987abe6ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x944E 18340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.