Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b0f4ca6961869ff…

MALICIOUS

PDF

34.8 KB Created: 2021-06-19 04:28:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29
MD5: 0aee76d703b71a61a340740428685b98 SHA-1: 362d50aab83cc8759dd3f601afd951cf5be77f48 SHA-256: 4b0f4ca6961869ff0aae2a3f9333e5f1188d8a272477f4a79404c8cfdbcdc688
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded links to known malicious redirector infrastructure, specifically targeting users with lures related to popular games like Roblox and Minecraft. The document body and extracted URLs suggest a phishing attempt to trick users into downloading malicious files disguised as game hacks or free item generators. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-prison-life-v2.0.2-gui-hack-game-hack In PDF document text
    • http://sellitafrica.com/media/storage/editor/files/roblox-studio-free-download_GM431946152.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/how-to-get-minecraft-for-free-on-ps4-2021_GM479516143.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/i-robux_GM431946152.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/500-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/minecraft-free-download-android_GM479516143.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/free-robux-no-human-verification-or-survey-or-download-2021_GM431946152.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/is-minecraft-free-on-xbox_GM479516143.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/hack-coin-master-ios_GM406889139.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/coin-master-free-coins-and-spins-link_GM406889139.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/aristois-minecraft-hack_GM479516143.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/earn-robux-today-earn-robux-today_GM431946152.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/coin-master-free-link-spin_GM406889139.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/coin-master-15-free-spin-link-of-last-5-days_GM406889139.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/rbx-place-free-robux_GM431946152.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/minecraft-classic-free_GM479516143.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/free-robux-credit-card_GM431946152.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/free-robux-generator-no-human-verification_GM431946152.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/free-spin-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/free-tiktok-followers-no-human-verification-or-survey-2021_GM835599320.pdfIn PDF document text
    • http://sellitafrica.com/media/storage/editor/files/minecraft-dungeons-free-download-pc_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fe4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2FE4 22260 bytes
SHA-256: d55d346292ab515465b9ccba2b0b7e2d7fe13d68c91bb2ed30a0f49ae7cd07dc
font_01_sfnt_off00006153.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6153 19564 bytes
SHA-256: 58cf415a4e2cae1f11850897c2bedd30ef2fd60cc30b02bf3f25ebc0abe81009

Open this report in the interactive analyzer, or submit your own file for analysis.