Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b57a33d781aa432…

MALICIOUS

PDF

44.3 KB Created: 2021-05-22 06:08:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: f7a97eb0e316eb103c1b2ce1b4c3b8a2 SHA-1: e79267694abea14f268ebdd81ba283e171086be8 SHA-256: 1b57a33d781aa43299fca1e8ee767246ee675287078f14da49f7907975bc4ec0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains heuristics indicating urgency lures and visual download buttons, combined with an embedded URI pointing to a site offering 'free Robux'. The document body, though partially corrupted, also contains similar text and a link to the same malicious domain. This suggests a phishing or scam attempt designed to trick users into visiting a malicious site, likely to download further malware or engage in fraudulent activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9503

Heuristics 5

  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-get-free-robux-without-verification-or-surveys-game-hack
    • https://www.chorwacjaapartamenty.com/images/tiktok-follower-bot-free_GM835599320.pdf
    • https://www.chorwacjaapartamenty.com/images/free-spin-coin-master-link-2021_GM406889139.pdf
    • https://www.chorwacjaapartamenty.com/images/free-minecraft-texture-packs-java_GM479516143.pdf
    • https://www.chorwacjaapartamenty.com/images/free-roblox-glasses_GM431946152.pdf
    • https://www.chorwacjaapartamenty.com/images/2021-free-spins-coin-master-link_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000355e.bin
8e07a6f24454ee284ce393e1ebc512fbc5aada916376210e59767c58f54607a3		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x355E 37484 bytes
font_01_sfnt_off000088f0.bin
30551668946d9b3d80fdd5a427c07e5f2c52faec585ae3c44dbbbd4d67cc7463		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88F0 19424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.