Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f06b088fda097fd…

MALICIOUS

PDF

34.9 KB Created: 2021-06-20 12:07:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 13558a6c9be499d847d12cf0ce01c3f7 SHA-1: 1ef6f57096509c0d58077604d4a91787a74c889f SHA-256: 7f06b088fda097fdcf0a61d5a7feae84239756c9a139234e7763012a1aba2b86
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document impersonates Facebook to lure users into downloading a malicious application, likely for Roblox or Coin Master cheats. The ML classifier strongly flagged this sample as malicious, and the embedded URLs point to suspicious download sites. The document's intent is to trick users into executing a potentially harmful second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://netcdn.co/app/431946152/application-pour-hacker-roblox-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/application-pour-hacker-roblox-game-hack PDF link annotation
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/apps-for-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/minecraft-bedrock-server-hosting-free_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/robux-without-verification_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-free-hat-pastebin_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/legit-coin-master-hack-no-human-verification_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/hacks-for-coin-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-hacked-version-download_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-free-spins-and-chips_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/how-to-hack-roblox-accounts_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-games-that-actually-work-2021_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-free-spins-2021-generator_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-spins-coin-master-app_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coin-master-today_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-now_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/coun-master_GM406889139.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/robux-hack-me_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-hacked-com-2021_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/classic-minecraft-net-hacks_GM479516143.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/roblox-rape_GM431946152.pdfIn PDF document text
    • http://www.technibuild-group.com/uploaded_files/userfiles/files/free-robux-com-roblox_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000319a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x319A 22084 bytes
SHA-256: e00befe483ef295a91b420c74defff4749f5d3cc3a356b6947a21c25b0d10e87
font_01_sfnt_off0000626e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x626E 19348 bytes
SHA-256: 970c39ca923dec9b02322f2e7647e20ae62eea37ab704e71c88c47cd8c8f35a2

Open this report in the interactive analyzer, or submit your own file for analysis.