Malicious PDF — malware analysis report

Static analysis result for SHA-256 5307fb34115f97d4…

MALICIOUS

PDF

44.2 KB Created: 2021-04-30 00:30:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-12
MD5: 068289fe61a22de22a6ba68cde4de01e SHA-1: f71f3d1a78201b90715a1624270a38274010ed7e SHA-256: 5307fb34115f97d49c24dad4069dd9197bc1ced749c064320f56e09fae885852
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains embedded links to known malicious redirector infrastructure, specifically pointing to a file named 'roblox-hack-v2-1.1-game-hack'. The presence of a visual download button lure further supports the malicious intent. The document's content and linked URLs suggest a social engineering attempt to trick users into downloading potentially harmful software.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9868

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-hack-v2-1.1-game-hack In PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/free-brown-hair-roblox.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/free-roblox-codes-2021.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/free-robux-on-phone-no-verification.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/infinitejump-hack-roblox.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/hacked-server-roblox-id.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/how-to-hack-someones-account-on-roblox-2021.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/free-roblox-estudios.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/roblox-developer-console-hack.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/free-holiday-crown-roblox.pdfIn PDF document text
    • http://kpu-klungkungkab.go.id/new/public/ckfinder/userfiles/files/no-survey-roblox-free-robux.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000043f1.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x43F1 26284 bytes
SHA-256: 7136f7ec2c0b0ca8709d4497a91051be2b7a349a9af79aadd0c3f5c9283e37fa
font_01_sfnt_off00007fc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FC7 2848 bytes
SHA-256: 4737c2778a085e0cb49e73f3b054b1a71e3f40720d213b4bfda97f95a31bfbf1
font_02_sfnt_off00008989.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8989 18612 bytes
SHA-256: 5af92d408ee88059395a02bfc9174ef91f514e73a24d42cfe82523afe5ec740d

Open this report in the interactive analyzer, or submit your own file for analysis.