Malicious PDF — malware analysis report

Static analysis result for SHA-256 1fb2b9a7bd5b0825…

MALICIOUS

PDF

49.2 KB Created: 2021-07-04 07:02:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 684780fc84470a8f595c770f7b342fe8 SHA-1: 46f55561ef84d2ee6e1839c9e66684eb0da3d956 SHA-256: 1fb2b9a7bd5b08257039c2d9f0d959ba3f7f5f7a2f390120bbc26fc44a809964
84 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a call-to-action phrase, strongly suggesting a phishing or malware distribution attempt. The ML classifier also flagged this PDF as malicious with high confidence. The presence of an embedded PDF with suspicious findings further supports the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 5

  • Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/claim-free-robux-game-hack PDF link annotation
    • https://vierabyragazze.com/upload/files/coin-master-free-soins_GM406889139.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/hacks-for-roblox-injectors_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/coin-master-free-coins_GM406889139.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/roblox-flood-escape-hack-script_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/free-roebucks_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/play-minecraft-online-free_GM479516143.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/how-to-change-my-name-in-roblox-for-free_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/tiktok-viewer-free_GM835599320.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/minecraft-iphone-free_GM479516143.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/bloxland-earn-free-robux_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/tryrbx-site-free-robux_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/robux-hack-no-verification_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/free-robux-real-working-2021_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/master-coin-free-spin_GM406889139.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/easy-robux-hack_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/coin-master-free-spins-and-coins-today_GM406889139.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/free-free-robux-for-android_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/how-to-get-free-knife-in-csgo-roblox_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/how-to-get-any-hat-in-roblox-for-free_GM431946152.pdfIn PDF document text
    • https://vierabyragazze.com/upload/files/coin-master-free-spins-link-2021-app_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6C65 21820 bytes
SHA-256: 4110ae518a801a436551bf431fa949f5faad8d59a4065aea2d907db8516aee80
font_01_sfnt_off00009c4a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9C4A 19168 bytes
SHA-256: dfc8721fbf6b4988d00971a58b16fe325011594e1ee6efadf5a4fdcf2df05fca
polyglot_child_pdf_off00004000.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x4000 33960 bytes
SHA-256: da50d0f3891795a584f65179942efc2817c16f3fe4ee02f8036c6b896341ccbb

Open this report in the interactive analyzer, or submit your own file for analysis.