PDF malware analysis — malicious · 2e5b77314ae217f7

MALICIOUS

PDF

35.1 KB Created: 2021-07-01 10:31:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: c7a537713118127fa962bf500d264b80 SHA-1: edb4eedf005e603425dea294383dedd38ece2b7c SHA-256: 2e5b77314ae217f7e85f72e2e3e7b8e755c7966f4afbacece58a0ca3daa6682e

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The document presents a lure for free Robux and game cheats, directing users to download a file from an external URL. The ML classifier strongly flagged this PDF as malicious, and the presence of a download button and password protection instructions further indicate a malicious workflow. The primary IOC is the external URL used for the payload delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/free-robux-no-password-plus-link-game-hack
- http://library.fk.upnvj.ac.id/repository/inspect-to-get-free-robux_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/roblox-rs-cheat-2021_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/skipe-hack-roblox-2021_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/haktutsin-2021-09-coinmaster50freespinandcoinlinkhtml-m-1_GM406889139.pdf
- http://library.fk.upnvj.ac.id/repository/roblox-free-suit_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/roblox-accounts-for-sale-free_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/neil-free-robux_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/daily-spin-and-coin_GM406889139.pdf
- http://library.fk.upnvj.ac.id/repository/roblox-goradiel-rpg-4-hacked_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/get-tiktok-followers-free_GM835599320.pdf
- http://library.fk.upnvj.ac.id/repository/how-to-get-free-robux-com_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/robuxglobalcom-no-verification_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/how-to-hack-roblox-items-on-to-your-account_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/coin-master-pc-game-free-download_GM406889139.pdf
- http://library.fk.upnvj.ac.id/repository/roblox-free-admin-hack_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/fly-hack-roblox-2021_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/is-minecraft-education-edition-free_GM479516143.pdf
- http://library.fk.upnvj.ac.id/repository/free-robux-no-verification-or-survey-2021_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/free-roblox-2021_GM431946152.pdf
- http://library.fk.upnvj.ac.id/repository/how-to-hack-roblox-accounts_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002f74.bin` `86ecefbb7e7368d5b2e3d3f9c62d5a9bdda6154208f743529e1b88cd779ccb51`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2F74	22788 bytes
`font_01_sfnt_off000062c6.bin` `0e7b188cef291628cfdc4f7f2e71f2efec8150a019c4e39ece5518c25287dda2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62C6	19572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.