Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c9584e59ba49830…

MALICIOUS

PDF

35.8 KB Created: 2021-06-26 13:47:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: c2e253b030d40048740e3d8d7d925e0f SHA-1: 2469c56aa13f93d8dc4a45fb95447fd6f3958fcd SHA-256: 7c9584e59ba49830c774911d7908e0aa6c8709c3ee636bf556e8a7d2813bcdd3
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains multiple embedded URLs and a heuristic firing for PDF_URI, indicating an attempt to redirect the user to external content. The document body, though partially corrupted, suggests a lure related to game hacks, specifically for Roblox. The presence of a 'Download Button' heuristic further supports the malicious intent of tricking users into downloading a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/xydia-roblox-hack-game-hack
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/roblox-xbox-free-items_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/free-roblox-virtual-items_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/como-hackear-roblox-en-celular_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/how-to-hack-your-self-getting-free-robux_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/how-to-get-free-robux-on-roblox-without-doing-anything_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku//repository/free-spins-coin-master-hack-2021_GM406889139.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku//repository/coin-master-free-coins-facebook_GM406889139.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/roblox-brick-cars-cheats_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/unpatchable-free-robux_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/coin-master-hack-without-verification-code_GM406889139.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/how-to-get-free-stuff-on-roblox-computer_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/minecraft-windows-10-edition-free-download_GM479516143.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/roblox-hacks-murder-mystery-2_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/armored-patrol-roblox-hack_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/roblox-cheat-engine-codes-2021_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/how-to-hack-roblox-accounts-on-phone-2021_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/crap-my-roblox-account-just-got-hacked_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/how-to-get-free-dominos-on-roblox_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/robloxcom-download-free-pc_GM431946152.pdf
    • http://uptperpustakaan.unismabekasi.ac.id/katalog-buku/repository/free-draw-2-roblox-drawing-tablet_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034b4.bin
074bbef10ef1ab1f484b1102121e3c4aa676834e76716cc63525d026c14fa954		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34B4 22536 bytes
font_01_sfnt_off000066cb.bin
32743250285beb73f05b4e0df2a34431eb9faf20a203f93c2ed60b0b4cbad03f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66CB 19128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.