Malicious PDF — malware analysis report

Static analysis result for SHA-256 40c19bca33b9d140…

MALICIOUS

PDF

36.5 KB Created: 2021-07-01 07:17:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 7451ddefd80b5e20b21758cec9a9ceef SHA-1: 8bbde602ef79a384d464da49d3b80d2f4a85ff11 SHA-256: 40c19bca33b9d140e5cd0363d2af73bd88447896567efd2b88d913e5743296af
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains embedded URLs and a visual download lure, suggesting an attempt to trick users into downloading malicious files. The ML classifier strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the overall context of offering 'free' game hacks points towards a phishing or malware distribution attempt, likely initiated via a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-code-robux-2021-game-hack PDF link annotation
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/coin-master-hack_GM406889139.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/how-to-hack-coin-master-ios-no-jailbreak_GM406889139.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/free-robux-sirws_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/noob-vs-pro-vs-hacker-vs-god-roblox-mad-city_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/free-robux-without-survey_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/how-to-disco-hack-roblox-games_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/free-tiktok-hearts_GM835599320.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/free-roblox-gfx_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/free-spins-coin-master-no-verification_GM406889139.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/how-to-get-free-clothes-on-roblox_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/free-roblox-accounts-with-robux-that-work-not-banned-2021_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/free-roblox-exploits_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/minecraft-complete-handbook_GM479516143.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/how-to-hack-roblox-accounts-on-phone-2021_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/scam-roblox-hack_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/insane-roblox-hacks_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/robux-hack-no-verification_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/how-to-get-free-robux-for-real_GM431946152.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/lucky-patcher-coin-master-hack_GM406889139.pdfIn PDF document text
    • https://elearning.manurululum.web.id/__statics/gudangsoal/files/coin-master-free-spins-link-march-2021_GM406889139.pdfIn PDF document text
    • https://www.roblox.com/.IIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003648.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3648 22576 bytes
SHA-256: 0821f3e462a7b248d092f747c216a3dbac4c29e1a4bd02bab95c018f1a935c39
font_01_sfnt_off000068cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x68CB 19292 bytes
SHA-256: b1e39429ad0924358057d95b30d84dc7479a9cbdeafed888aeee8ab617c3e635

Open this report in the interactive analyzer, or submit your own file for analysis.