Malicious PDF — malware analysis report

Static analysis result for SHA-256 40fa7398c8920f88…

MALICIOUS

PDF

33.0 KB Created: 2021-06-23 10:14:06 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: d50991877e00a4e3a687d31d3ae34f29 SHA-1: 21528a2cd6116956a4f1d95a5424f625a2189eb1 SHA-256: 40fa7398c8920f889662d176f6ee82b59b447c308f62e6ffacb83b37309bfe25
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs, including one pointing to a script for free Robux, indicating a lure for game-related cheats. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs and a download button lure further support a malicious intent. The document likely aims to trick users into downloading and executing a malicious script, potentially leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/script-for-free-robux-vid-game-hack PDF link annotation
    • http://katalog.ireyogya.org/repository/get-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/free-robux-apk-2021_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/coin-master-hacks-iphone_GM406889139.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/instagram-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/roblox-games-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/free-robux-no-verification-no-survey_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/free-spin-and-coin_GM406889139.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/roblox-hacks-com_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/free-spins-coin-master-march-2021_GM406889139.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/coin-master-free-spins-and-coins-for-iphone_GM406889139.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/roblox-games-com-free_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/roblox-fre-fsp_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/roblox-murdermystery-free-online_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/free-robux-apk_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/free-roblox-card-codes_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/how-to-hack-roblox-accounts-on-phone_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/free-minecraft-java-code_GM479516143.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/roblox-free-rbx-2021-june-hack-no-generator_GM431946152.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/static-moonactive_GM406889139.pdfIn PDF document text
    • http://katalog.ireyogya.org/repository/wwwcoin-master-hack-apk_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002cce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2CCE 21048 bytes
SHA-256: d158449290319d65c30684ab052ce8c3262e2ddc7e3b4ee080da13345e17794a
font_01_sfnt_off00005a86.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5A86 19424 bytes
SHA-256: 2cf17ee8ee47c2bf5f7184e1131bd53a19445fa6df2412ae0e419621739495ae

Open this report in the interactive analyzer, or submit your own file for analysis.