Malicious PDF — malware analysis report

Static analysis result for SHA-256 74266aaccbeecaf3…

MALICIOUS

PDF

37.0 KB Created: 2021-05-23 13:04:38 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: f976e6b762352061b103d0d51ea31c82 SHA-1: abd5ceebdbb94d7871bc1a058a7c3bf29c3a01e4 SHA-256: 74266aaccbeecaf346820d93324bec0e055c7add20aeedd7fa065ce0310d5469
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains lures for free Robux and game hacks, directing users to download files from external URLs. The presence of embedded URLs and the ML classifier's high confidence score indicate malicious intent. The document body explicitly mentions 'Give Me Free Robux' and 'CLICK HERE TO ACCESS ROBLOX GENERATOR', further supporting the phishing and malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9447

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/give-me-free-robux-game-hack PDF link annotation
    • http://ajmason.com/admin/ckfinder/userfiles/files/coin-master-free-box_GM406889139.pdfIn PDF document text
    • http://ajmason.com/admin/ckfinder/userfiles/files/coin-master-daily-free-spins-link-2021_GM406889139.pdfIn PDF document text
    • http://ajmason.com/admin/ckfinder/userfiles/files/hack-coin-master-2021_GM406889139.pdfIn PDF document text
    • http://ajmason.com/admin/ckfinder/userfiles/files/links-for-coin-master-free-spins_GM406889139.pdfIn PDF document text
    • http://ajmason.com/admin/ckfinder/userfiles/files/free-spins-coin-master-facebook_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off000032da.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x32DA 26188 bytes
SHA-256: fdf0eac62c09f97598a480aeccbf3756239e1e3c1deca9f497e7df2f8e1d5bfd
font_01_sfnt_off00006ef7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EF7 18444 bytes
SHA-256: 68319dbf483afe81c5a4de3b3f5290fc223d358c0f75f000dd988daf46eb7eae

Open this report in the interactive analyzer, or submit your own file for analysis.