Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c5df970944c48a6…

MALICIOUS

PDF

50.9 KB Created: 2021-06-03 05:52:36 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: b28bccc42cb3a238df402543eddf809a SHA-1: b57569c083a84a3cfe7800326e194b073a85310f SHA-256: 4c5df970944c48a662397cd5e9a9b1c0cfcebd29a54550f901aed630cb78458c
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains an embedded URL pointing to a file named 'robloxbux-us-generator-game-hack', suggesting a lure for in-game currency. The presence of a 'password-protected archive lure' heuristic indicates that the document likely intends to trick the user into downloading an encrypted payload, which is a common tactic for bypassing security filters. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9724

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/robloxbux-us-generator-game-hack PDF link annotation
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/claim-free-robux_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/202100-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/free-pet-food-coin-master_GM406889139.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/roblox-free-hair-boy_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/how-to-get-java-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/universal-minecraft-converter-free_GM479516143.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/minecraft-bedrock-hacks-windows-10_GM479516143.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/free-robux-generator-2021-no-human-verification_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/minecraft-windows-10-hacked-client_GM479516143.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/free-things-on-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/how-to-get-free-robux-youtube_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/free-robux-no-human-verification-or-survey-2021_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/tower-of-hell-roblox-hack_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/aristois-minecraft-hack_GM479516143.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/coin-master-hacks-for-spins_GM406889139.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/coin-master-hack-2021-no-human-verification_GM406889139.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/free-roblox-clothes-event_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id//repository/minecraft-bedrock-client_GM479516143.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/how-to-get-roblox-premium-for-free_GM431946152.pdfIn PDF document text
    • http://perpustakaan.poltekkespangkalpinang.ac.id/repository/how-to-get-free-robux-for-kids_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000537a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x537A 29124 bytes
SHA-256: 003d155c4b0b043c7ec72c0250d763e0ef27a622217d19d3e58e557be8d7ddf7
font_01_sfnt_off000093a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x93A9 6636 bytes
SHA-256: 62075f0fe13502d46afb6e55e83d440c29ef4988399537df1f86e7653ce3b744
font_02_sfnt_off0000a3b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA3B6 18444 bytes
SHA-256: 7917d6e924cb6db73036ee403938ed3af44b5ec1e3e3e35d9261f8b0f349792e

Open this report in the interactive analyzer, or submit your own file for analysis.