Malicious PDF — malware analysis report

Static analysis result for SHA-256 694e11a801fac035…

MALICIOUS

PDF

42.6 KB Created: 2021-04-25 19:16:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: b92851d473821b2de0419464316d2eef SHA-1: d3e6a00b3fa5d04ad6e279eb8073f94bc3c70dfa SHA-256: 694e11a801fac035fa53fa5cdd33a29661ff161c5fd7d1d572bbbd24d0a0bebc
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The document employs a social engineering lure related to free Robux and Roblox game hacks, directing users to download files or install browser extensions. The embedded URLs and the document body content strongly suggest a phishing or malware distribution attempt. While no scripts were directly extracted, the PDF structure and heuristics indicate it's designed to trick users into executing malicious code or visiting malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 4

  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-no-human-verification-2021-trackid-sp-006-game-hack
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/how-to-get-the-free-dragon-wings-on-roblox.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/roblox-wizard-pants-free.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/play-free-roblox-com.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/dragon-egg-backpack-roblox-free.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/roblox-hack-download-robux.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/indetectable-cheat-roblox-fly.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-jailbreak-new-hack-2021-working.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/roblox-zone-free.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/descargar-hack-roblox-jailbreak-2021.pdf
    • http://learning.system.mammhpucakwangi.sch.id/__statics/gudangsoal/files/roblox-lucky-block-battlegrounds-cheats.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000432c.bin
f0d350e9cb8f2cce9840450e32a6918b2222db257358ea7c2635205f5578ca08		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x432C 26780 bytes
font_01_sfnt_off00007f7c.bin
df1c60906164bfa68c5a3a6532510d99a2034ea5482265e0d441427170850ed8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F7C 19984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.