Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b9ddb0d88145673…

MALICIOUS

PDF

34.9 KB Created: 2021-06-30 10:26:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 89536289b1094c6d962bbd12c8ff15fd SHA-1: 6fb036fd2eec33f1735521965a8f88afaab2289f SHA-256: 7b9ddb0d88145673bc66821f1d5fc361e80fe0db150764dbbf901b1761a26d11
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains lures and embedded URLs related to hacking online game accounts, specifically Roblox. The ML classifier and heuristic firings strongly indicate malicious intent, likely to trick users into downloading malware or visiting malicious sites. The presence of 'cmd-game-hack' in the document text and the external URI pointing to a potential exploit further support this. No scripts were extracted, but the document's content and URLs suggest a phishing or social engineering attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-hack-accounts-on-roblox-with-cmd-game-hack
    • https://www.stomatoloska-ordinacija-rijeka.com/files/hacked-roblox-shirt_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/descargar-roblox-hackeado-adopt-me-2021_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/coin-master-facebook-free-spins_GM406889139.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/roblox-royale-high-diamond-hack_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/coin-master-daily-free-spin-app_GM406889139.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/robux-best_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/roblox-como-hackear-la-cuenta-de-tu-amigo_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/coin-master-free-spins-and-coins-today-gift-reward_GM406889139.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/coin-master-free-spin-and-coins-links_GM406889139.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/roblox-free-hair-boy_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/coin-master-hack-coins_GM406889139.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/pastebin-roblox-hack-2021_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/ccv3-roblox-hack-how-to-through-walls-new-2021_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/free-items-roblox-hack_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/how-to-get-free-robux-with-no-verification_GM431946152.pdf
    • https://www.stomatoloska-ordinacija-rijeka.com/files/coin-master-free-spins-and-chips_GM406889139.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/roblox-hack-apk-pc-download_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/mathep_GM431946152.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/free-coin-master-spins-and-coins-for-daily_GM406889139.pdf
    • http://stomatoloska-ordinacija-rijeka.com/files/best-free-minecraft-servers_GM479516143.pdf
    • http://netcdn.co/app/431946152/how-to-hack-acc
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000319d.bin
eefb0f055eb3246889e5de643f82692330fc882c5f55c20a8f8035cc356af51e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x319D 21448 bytes
font_01_sfnt_off000060a8.bin
3026b0bd1e015b36d15e2469f3be85562195465f540609a450773926da7f89c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60A8 19984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.