Malicious PDF — malware analysis report

Static analysis result for SHA-256 4916fcaad54a8d44…

MALICIOUS

PDF

46.9 KB Created: 2021-04-27 09:55:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 203122445ba7f3b64941cab134a8fa7b SHA-1: bdd95989be3932eb4dde9f4cfb1c1fc8335bd855 SHA-256: 4916fcaad54a8d44f80a24d605267b60d2611efbca6b44fd967d3fbb536448ff
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document uses a lure related to 'Free Roblox Condo' and 'game hack' to entice users. It contains embedded URLs pointing to potentially malicious content and includes a heuristic indicating a lure for clipboard command execution, suggesting the user might be prompted to paste commands into a shell. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9747

Heuristics 4

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-roblox-condo.-game-hack PDF link annotation
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/how-do-you-hack-to-hack-on-roblox.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/free-robux-glitch-2021-working.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/free-items-on-roblox-pastebin.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/hacks-para-tener-robux-gratis-2021.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/terminal-railways-have-a-train-free-roblox-new-update.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/getbucks-me-robux-free.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/free-robux-pointsprizescom.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/roblox-how-to-get-free-robux-in-seconds-2021.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-apex-spice.pdfIn PDF document text
    • https://mismuh-kota-utara.sch.id/__statics/gudangsoal/files/all-script-roblox-hack.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004192.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4192 25224 bytes
SHA-256: 6d63a5307490b737f32b79d480248ce23bb2f66b507b396ec66a4ad7065487a7
font_01_sfnt_off00007ae1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7AE1 11440 bytes
SHA-256: 154d59d1680f2d1e38ccb783d6997f344290d121007e51df331726de4128c12e
font_02_sfnt_off00009602.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9602 18188 bytes
SHA-256: 7b2dfe612f726d724911f94bdd89a79b50b2cd7c4908c85c1c43e07e648476f6

Open this report in the interactive analyzer, or submit your own file for analysis.