PDF malware analysis — malicious · 35365b30bc9ca4e0

MALICIOUS

PDF

33.9 KB Created: 2021-07-01 13:35:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 4108e530a3d526c230d42688aecb896b SHA-1: a494d8e8dad13e14a4b730b875fda80d2be5644d SHA-256: 35365b30bc9ca4e0ec3f786030bd4fc4b9dd2fe4f1568a34ee51ab74f02a9a2d

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains numerous URLs pointing to game-related cheats and hacks, suggesting a social engineering lure. The heuristic 'SE_LOLBIN_RUN_COMMAND' indicates the presence of command-line execution tokens within the document text, specifically referencing 'cmd_GM431946152.pdf' and a URL from 'titastar.com', which likely facilitates the download of a malicious payload. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9824

Heuristics 4

LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/fly-cheat-2021-roblox-game-hack
- https://www.titastar.com/uploaded_files/userfiles/files/minecraft-free-app_GM479516143.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/743-robloxhack-exploit-838fczip_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/optifine-minecraft-pe_GM479516143.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/how-to-get-free-robux-on-roblox_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/freerobuxklub_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/dragon-ball-x-in-roblox-hack-pastebin_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/roblox-free-muscles_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/free-roblox-gear_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/free-robux-and-tickets-generator-2021_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/coin-master-daily-free-spins-blogspot_GM406889139.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/coin-master-free-spins-link-download_GM406889139.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/how-do-you-get-roblox-money_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/how-to-hack-roblox-using-cmd_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/free-robux-generator-no-human-verification-2021_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/free-tiktok-views-no-verification_GM835599320.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/free-robux-codes-2021-and-how-to-imput-them_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/free-vip-server-roblox-anime-battlegrounds_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/how-to-get-free-roblox_GM431946152.pdf
- https://www.titastar.com/uploaded_files/userfiles/files/high-school-life-hack-roblox_GM431946152.pdf
- https://www.titastar.com/uploaded_files/
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002be1.bin` `6d42caab0dd4df4f016bb6bf465da3d44b6192cf553a6bee8c147d0e2804e4ca`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2BE1	22572 bytes
`font_01_sfnt_off00005e28.bin` `64fbb6dff58ff01f1466cd69102db85c74711e611095f5cf2d33a9ebe582d1f3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E28	19504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.