Malicious PDF — malware analysis report

Static analysis result for SHA-256 3172ac6b39d94497…

MALICIOUS

PDF

47.7 KB Created: 2021-06-14 01:15:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 145b1d004a166b8f18b19ef34f23158e SHA-1: 15b265aeabb88b65ed654dc95a7c6f6facbb8ef6 SHA-256: 3172ac6b39d9449743473cd6e96f2b8a4eab248e62c281874869c8260d6fffb2
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document impersonates Apple and uses a lure related to 'free Roblox shirts' to trick users into clicking on a malicious URL. The ML classifier strongly flagged this PDF as malicious, and the embedded URLs point to suspicious domains. While no scripts were directly extracted, the PDF structure and heuristics suggest it's designed to facilitate the download of a second-stage payload, likely exploiting a client execution vulnerability.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9013

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://netcdn.co/app/431946152/free-roblox-shirts-template-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-roblox-shirts-template-game-hack PDF link annotation
    • http://digilib.iailm.ac.id/repository/avast-bloque-les-cheats-roblox_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/win-free-robux_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/coin-master-hack-android_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/free-robux-legit_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/free-roblox-outfits_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/earn-robux-today_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/minecraft-114-4-download_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/coin-master-free-gift-link-2021_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/coin-master-hack-online-download_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/how-to-hack-a-minecraft-server-and-make-yourself-op_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/free-spins-for-coin-master-that-work_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/unlimited-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/get-free-robux-without-human-verification_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/cheats-coin-master-free_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/how-to-make-your-own-minecraft-server-for-free_GM479516143.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/free-robux-group_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/free-daily-spin-coin-master-game_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id/repository/moonactive-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/free-roblox-card_GM431946152.pdfIn PDF document text
    • http://digilib.iailm.ac.id//repository/how-to-hack-minecraft-pe_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004d14.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4D14 25620 bytes
SHA-256: 60499e6b7c8ecda37d7afc518f8df5679a07dc4dbf6a5c2da10efa5dc30a3e2b
font_01_sfnt_off000088d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x88D1 5596 bytes
SHA-256: 9a13c2580265a78e8a7257496a31ee0055738af7e20a5661c2902efe4bf05ce5
font_02_sfnt_off00009578.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9578 19188 bytes
SHA-256: 90d95b90e09b602e08c0afde99a155c5f95b59ce3cb7ba76e08ff2a058bf8f32

Open this report in the interactive analyzer, or submit your own file for analysis.