Malicious PDF — malware analysis report

Static analysis result for SHA-256 797406b9199e4e62…

MALICIOUS

PDF

44.7 KB Created: 2021-06-14 01:44:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 162a09c83f5520fd5bdc122b14101116 SHA-1: 1395136a332a339c72e4e35edf89a5324ce9b99b SHA-256: 797406b9199e4e62a53339c85a20ec21a3ecc2df144bbe037791f449745daf20
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged by an ML classifier as malicious. It contains external URIs and embedded URLs that impersonate the brand Apple, directing users to download content from a non-affiliated domain. The presence of a visual download button further supports the lure to download potentially harmful files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://netcdn.co/app/431946152/roblox-trade-free-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-trade-free-game-hack PDF link annotation
    • http://perpustakaan.pn-tapaktuan.go.id/repository/earn-free-robux-instantly_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/coin-master-free-spins-link-2021-today_GM406889139.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/roblox-arsenal-hack_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/free-executors-for-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-hack-any-roblox-account_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-get-free-followers-on-tiktok_GM835599320.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/roblox-bux-free_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/minecraft-wurst-hacked-client_GM479516143.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-get-xbox-skin-for-pc-roblox-free_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/minecraft-diamond-finder-hack_GM479516143.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/free-spin-appscoin-master_GM406889139.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/game-coin-master-hack_GM406889139.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/daily-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-hack-robux_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-get-creative-mode-in-minecraft-server-hack_GM479516143.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/how-to-get-free-robux-for-real_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/roblox-free-accessories_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/adf-ly-robux-hack_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/free-trading-roblox_GM431946152.pdfIn PDF document text
    • http://perpustakaan.pn-tapaktuan.go.id/repository/free-minecraft-account_GM479516143.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004910.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4910 30668 bytes
SHA-256: d14acaeac067bf924878c34791a7a64d2226bca3c73f42a4c3374fd1bd3100c0
font_01_sfnt_off00008bb5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8BB5 18536 bytes
SHA-256: c762d1354299614896acac2457c67ab5488c9a17a82c3d0de49ba1eec0fad147

Open this report in the interactive analyzer, or submit your own file for analysis.