Malicious PDF — malware analysis report

Static analysis result for SHA-256 507b610ea43104d0…

MALICIOUS

PDF

43.2 KB Created: 2021-05-13 15:10:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 842455d4525f61a07c0f7fb5b777611b SHA-1: 6a985dbfd4a03358fe65fd0d83f58ce8cc8d6ebc SHA-256: 507b610ea43104d0ad1eb16d80146fe405075124c52729491a2087cfafcb3942
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document uses a lure for free Robux, a virtual currency, to trick users into downloading a malicious application from the provided URL. The ML classifier strongly flagged this PDF as malicious, and the content aligns with an advance-fee scam. The primary IOC is the external URI pointing to a potential malware download site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 4

  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-app-2021-game-hack
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-daily-bonus_GM406889139.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-hack-apk-app_GM406889139.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/free-spins-coin-master-2021_GM406889139.pdf
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/free-robux-kid-friendly-no-human-verification_GM431946152.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/synapse-roblox-free-download_GM431946152.pdf
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/freespinandcoin_GM406889139.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coinmaster-free-cards_GM406889139.pdf
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/how-to-win-free-robux_GM431946152.pdf
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/free-roblox-accessories_GM431946152.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/como-hackear-coin-master-iphone_GM406889139.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/free-spins-coin-master-facebook_GM406889139.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-mod-version-free-download-2021_GM406889139.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-hack-ios-without-verification_GM406889139.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-accounts-2021_GM431946152.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-free-daily-spins-link_GM406889139.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/free-robux-codes-2021_GM431946152.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/minecraft-realms-free-codes_GM479516143.pdf
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/minecraft-realms-free_GM479516143.pdf
    • https://elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/claim-free-robux-button_GM431946152.pdf
    • https://www.elearning.man1bukittinggi.sch.id/__statics/gudangsoal/files/coin-master-free-spins-1-coin-master_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000049d4.bin
0062d0e718a19cfd3e2258a678cd6c9a65a15c3a297553cd9be0d73e118abddb		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x49D4 26396 bytes
font_01_sfnt_off00008584.bin
60f15d8ca37119d38c609a47832113b3700b54b9c09a2f40fa09148dabf0e544		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8584 18592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.