Malicious PDF — malware analysis report

Static analysis result for SHA-256 330a3fb1dce2a16c…

MALICIOUS

PDF

44.2 KB Created: 2021-06-11 04:02:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: fa114430137630fb9140368a12f438fd SHA-1: effd685362d8eb4dd1a0dadde99c17eedfff2ee9 SHA-256: 330a3fb1dce2a16c5560ae31f4e05e6a313bbf90587bca248c0b0286832576ec
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains lures related to free in-game currency for Roblox, combined with a high-confidence ML classification and embedded URLs pointing to suspicious domains. The presence of a 'payment redirection lure' heuristic suggests a potential financial scam or credential harvesting attempt. The primary attack pattern involves tricking the user into clicking a link to download a malicious payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9865

Heuristics 4

  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-code-to-a-roblox-robux-reedeem-card-game-hack
    • http://www.smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/roblox-hack-me_GM431946152.pdf
    • http://www.smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/robux-free-c_GM431946152.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/free-robux-no-anti-bot-verification_GM431946152.pdf
    • http://www.smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/how-to-make-my-own-coin-master-cards-hack_GM406889139.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/free-minecraft-generator_GM479516143.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/tiktok-free-package_GM835599320.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/how-to-get-free-roebucks-without-verification_GM431946152.pdf
    • http://www.smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/how-to-downgrade-minecraft-pe_GM479516143.pdf
    • http://www.smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/how-to-get-free-robux-website_GM431946152.pdf
    • http://www.smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/arsenal-hacks-roblox_GM431946152.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/minecraft-anarchy-server-no-hacks_GM479516143.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/robux-com-free_GM431946152.pdf
    • http://www.smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/how-do-you-get-free-robux-2021_GM431946152.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/coin-master-daily-spin-link-app_GM406889139.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/coin-master-hack-2021_GM406889139.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/roblox-free-roblox_GM431946152.pdf
    • http://www.smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/minecraft-esp_GM479516143.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/free-robux-quiz_GM431946152.pdf
    • http://smkn1kutaselatan.sch.id/new/public/ckfinder/userfiles/files/easy-how-to-get-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005174.bin
6c6fc5a74d110403c1dfe59cb3568b410a8718e1113005b24d59c7b56f3ddc90		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5174 24420 bytes
font_01_sfnt_off000088f1.bin
3e6efc9df20ea2d722dc3eb7470fc32924b0814d5e3501b9fd35ad720daed7e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88F1 18748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.