Malicious PDF — malware analysis report

Static analysis result for SHA-256 272178548cdc254b…

MALICIOUS

PDF

44.6 KB Created: 2021-06-08 21:58:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 0789b0d411063070c3a04e1a832791da SHA-1: 1a08fc9644003157badfb1ba5f8236cfee80de1a SHA-256: 272178548cdc254b6f0f4aedbe148123cbd319c9803b6991925e85d65110062b
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document contains lures for free Robux and game hacks, directing users to external URLs for downloads. It also contains instructions to disable security software, indicating a malicious intent to bypass defenses. While no scripts were extracted, the presence of embedded URLs and the security bypass heuristic strongly suggest the document is designed to facilitate the download and execution of a secondary payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 4

  • Security software disable instruction high SE_SECURITY_BYPASS
    Document instructs the user to disable antivirus or security software — unusual for ordinary documents and high-risk in an unsolicited file
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-robux-codes-october-2021-game-hack
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/minecraft-pe-free-apk_GM479516143.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/how-to-hack-roblox-to-get-robux_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/minecraft-hacks_GM479516143.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/is-there-a-way-to-get-minecraft-for-free_GM479516143.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-robux-pc-2021_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-coin-master-spins-and-coins_GM406889139.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/roblox-fly-hack_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-robux-without-human-verification-on-ipad_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-robux-com_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/coin-master-free_GM406889139.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-robux-giveaway_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/minecraft-free-app_GM479516143.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-robux-generator-no-verification_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/robux-free-c_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/roblox-robux-hack_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/can-we-play-roblox-for-free_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-robux-app-2021_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/how-to-earn-free-robux_GM431946152.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-tiktok-likes-app_GM835599320.pdf
    • https://elearning.man4banjar.com/__statics/gudangsoal/files/free-spins-coin-master-app_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005193.bin
aed2897248ee7cb8970e51f10acb662ba220504dff649a38b11b5ec99109846d
decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5193 24632 bytes
font_01_sfnt_off00008a1f.bin
3bea4f238302f4053ef03cbe8433912c216fb3457390a639c651b85fa68e5ce6
pdf-font-stream PDF embedded font (sfnt) at offset 0x8A1F 18696 bytes