Malicious PDF — malware analysis report

Static analysis result for SHA-256 34dd8b99d1601af7…

MALICIOUS

PDF

47.4 KB Created: 2021-06-10 14:31:23 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 4cec19fa03f3aee4fd05b54375f4d87d SHA-1: 0bbc27a5eda19628b8597dc8486571537283cce7 SHA-256: 34dd8b99d1601af71016398e6f231dfd8fa98871cc765a235ea5828fde71443e
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document employs a lure for free Robux to trick users into revealing sensitive information, such as private keys or recovery secrets. The document contains multiple embedded URLs pointing to external resources, including one at `https://netcdn.tw/app/431946152/free-robux-nicsterv-game-hack`, which likely serves as the payload delivery mechanism. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9769

Heuristics 4

  • Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE
    Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-robux-nicsterv-game-hack PDF link annotation
    • http://www.marambio.com.ar/images/minecraft-free-download-unblocked_GM479516143.pdfIn PDF document text
    • http://www.marambio.com.ar/images/earn-robux_GM431946152.pdfIn PDF document text
    • http://www.marambio.com.ar/images/minecraft-redeem-code-free-2021_GM479516143.pdfIn PDF document text
    • http://www.marambio.com.ar/images/coin-master-free-spins-link-2021_GM406889139.pdfIn PDF document text
    • http://www.marambio.com.ar/images/how-to-get-free-robux-without-verifying-2021_GM431946152.pdfIn PDF document text
    • http://www.marambio.com.ar/images/free-robux-without-human-verification-real_GM431946152.pdfIn PDF document text
    • http://www.marambio.com.ar/images/minecraft-pe-apk_GM479516143.pdfIn PDF document text
    • http://www.marambio.com.ar/images/free-spins-for-coin-master-game_GM406889139.pdfIn PDF document text
    • http://www.marambio.com.ar/images/free-robux-no-human-verification-or-survey-2021_GM431946152.pdfIn PDF document text
    • http://www.marambio.com.ar/images/coin-master-free-100-spin-link_GM406889139.pdfIn PDF document text
    • http://www.marambio.com.ar/images/pig-master-free-spins-and-coins_GM406889139.pdfIn PDF document text
    • http://www.marambio.com.ar/images/how-to-get-minecraft-for-free-on-xbox-360_GM479516143.pdfIn PDF document text
    • http://www.marambio.com.ar/images/minecraft-education-edition-free-download_GM479516143.pdfIn PDF document text
    • http://www.marambio.com.ar/images/how-do-you-get-robux_GM431946152.pdfIn PDF document text
    • http://www.marambio.com.ar/images/minecraft-pe-hacks_GM479516143.pdfIn PDF document text
    • http://www.marambio.com.ar/images/how-to-get-minecraft-for-free-on-your-phone_GM479516143.pdfIn PDF document text
    • http://www.marambio.com.ar/images/hack-coin-master-ios-download_GM406889139.pdfIn PDF document text
    • http://www.marambio.com.ar/images/coin-master-15-free-spin-link-of-last-5-days_GM406889139.pdfIn PDF document text
    • http://www.marambio.com.ar/images/free-robux-no-scam_GM431946152.pdfIn PDF document text
    • http://www.marambio.com.ar/images/free-robux-hack-generator_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ae8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4AE8 29016 bytes
SHA-256: 363648688e16b41fea4f027a08131779ce4d768eb0e1259cd86db5ad046a1847
font_01_sfnt_off00008c63.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C63 2888 bytes
SHA-256: dcdd98ee8e25436a83587ccb4027347dd2c3fcec95f3413942edd4086125bcca
font_02_sfnt_off00009637.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9637 18352 bytes
SHA-256: d5cd740a869c1beb6b0652b1f5963ffc8962d8a69b36ec7f3c089014bf46553a

Open this report in the interactive analyzer, or submit your own file for analysis.