Malicious PDF — malware analysis report

Static analysis result for SHA-256 662d420f98b487b8…

MALICIOUS

PDF

46.7 KB Created: 2021-06-10 18:44:02 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 0cf92efac656cbb810c6bba6c62d396c SHA-1: b552406e121d7dd1e44318e04bfeb12fe1ff0837 SHA-256: 662d420f98b487b874303c3d7016882145b4f6744d716306f6546d8027635fea
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains a lure related to 'Hack Game Roblox Robux' and includes an embedded URL pointing to a potential download. The presence of a 'Password-protected archive handoff' heuristic suggests that the user is expected to download an archive, possibly with a password provided within the document, to access the malicious payload. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9832

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/hack-game-roblox-robux-game-hack
    • http://elibrary.uniyap.ac.id/repository/free-roblox-hacks-net_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/how-to-cheat-in-roblox-find-the-doges_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/free-robux-obby-no-password-no-human-verification_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/free-robux-without-phone-number_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/roblox-players-for-free_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/roblox-rs16-5-hacks_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/free-promo-codes-2021-roblox_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/roblox-free-visit-bots_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/roblox-robux-hack-console_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/how-do-u-hack-roblox-free-robux_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/roblox-hacked-version-download-apk_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/hacker-tool-for-roblox-download_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/roblox-how-to-get-free-robux-2021-hacks-no-scam_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/free-robux-hack-proof_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/free-roblox-render_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/hack-roblox-pc-aimbot-download_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/roblox-hack-2021-september_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/is-the-robux-hack-safe_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/hack-how-to-get-captain-underpants-cape-roblox_GM431946152.pdf
    • http://elibrary.uniyap.ac.id/repository/red-boy-cheat-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000525c.bin
714e789631db2fdf732f32c152631debec35a7a7cf059fd3ed54d96cd0277584		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x525C 29496 bytes
font_01_sfnt_off00009320.bin
e13664a3ca8e9981254dc145470536213cc6c4af93dca2beda41a0d8bf319f9f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9320 18584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.