Malicious PDF — malware analysis report

Static analysis result for SHA-256 7908cf28229db2ac…

MALICIOUS

PDF

50.0 KB Created: 2021-06-11 11:05:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: db0e6d21ac13ef7001fb384b38e11e6c SHA-1: 00d4518b413880a44020037c720d61aeb70f9ad4 SHA-256: 7908cf28229db2acd44a01ada9b05498a78dd92511ed0768631044d87de258f0
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains embedded URLs and a call-to-action phrase, strongly suggesting a lure to download a malicious payload. The ML classifier also flagged this PDF as malicious with high confidence. The document body, though heavily obfuscated, contains references to 'Free Robux' and game-related terms, aligning with common scam lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9796

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/free-robux-on-ipad-pro-game-hack
    • http://mtsn-baranti.com/perpus/repository/coin-master-heaven-free-spins-today_GM406889139.pdf
    • http://mtsn-baranti.com/perpus/repository/play-roblox-free-online_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/how-to-get-more-robux-for-free_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/free-spins-coin-master-october-17-2021_GM406889139.pdf
    • http://mtsn-baranti.com/perpus/repository/free-accessories-roblox_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/coin-master-hack-apk-april-12-2021_GM406889139.pdf
    • http://mtsn-baranti.com/perpus/repository/if-i-uninstall-minecraft-can-i-reinstall-it-for-free_GM479516143.pdf
    • http://mtsn-baranti.com/perpus/repository/how-to-gain-more-spins-on-coin-master-for-free_GM406889139.pdf
    • http://mtsn-baranti.com/perpus/repository/roblox-army-free-robux_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/how-to-get-free-robux-without-verification_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/www-bandicam-com-free-robux_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/robux-fun-hack_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/free-roblox_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/rbxcity-free-robux_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/coin-master-hack-without-verification-or-downloading-apps_GM406889139.pdf
    • http://mtsn-baranti.com/perpus/repository/minecraft-apk-download-v1-144-2-free_GM479516143.pdf
    • http://mtsn-baranti.com/perpus/repository/free-robux-generator-no-human-verification_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/free-robux-reddit_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/free-robux-real_GM431946152.pdf
    • http://mtsn-baranti.com/perpus/repository/free-spins-october-28-2021-coin-master_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005348.bin
1516f270aedce9564013ff801f21d605ee956dc5000b5d407a2d6fd4da9c6ee0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5348 28116 bytes
font_01_sfnt_off000095ef.bin
d88f25cfe237a714f996150a11dd8a058f0f7c3e9d1ae91c17b46c10409b6c0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x95EF 2820 bytes
font_02_sfnt_off00009f8a.bin
8cc0f83fa3c604bf0b33af2b9332da8b1d0b81549aaebaf7361ecf1ea719d237		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F8A 18744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.