Malicious PDF — malware analysis report

Static analysis result for SHA-256 8173ca29351e8063…

MALICIOUS

PDF

33.6 KB Created: 2021-06-28 20:17:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 219636a66c0ca198f6efece0c9135db3 SHA-1: c596712ce2601aabec3bc0a9e4442208eec88b02 SHA-256: 8173ca29351e8063e9bc1ee8683e275a8685eb3ab3535de8d89a91bef6fcae6e
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous URLs and text referencing 'Roblox', 'Robux', and 'hacks', indicating a lure for free in-game currency. The heuristic 'SE_LOLBIN_RUN_COMMAND' and the presence of external URIs suggest that clicking these links may execute commands or download further malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a scam or malware delivery attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9824

Heuristics 4

  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/for-free-drake-roblox-id-game-hack
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/roblox-insert-tool-hack_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/how-to-get-free-tiktok-coins_GM835599320.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/how-get-free-stuff-in-roblox_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/how-to-hack-teleport-a-player-in-roblox_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/roblox-quote-shirt-free_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/cmd-robux-hack-real_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/roblox-always-day-hack_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/how-to-get-free-robux-no-human-verification-mobile_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/setting-up-cheat-engine-for-roblox_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/hack-roblox-pc-aimbot-download_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/free-robux-g_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/free-gift-card-roblox-wix_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/adidas-t-shirt-roblox-free_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/free-robux-rapido_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/2021-how-to-get-free-robux_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/free-robux-no-offers-or-human-verification_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/vest-t-shirt-roblox-free_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/how-to-hack-roblox-to-get-robux-without-human-verification_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/respoy/repository/free-robux-raw-pastebin_GM431946152.pdf
    • https://perpus.poltekkesjkt2.ac.id/setiadi/repository/roblox-browser-free_GM431946152.pdf
    • https://perpus.poltekkes
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002b39.bin
ef7af54b9eed20a6c2b654999b8a1e6ef6965236b5e3fc12dd092939d62161b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2B39 22732 bytes
font_01_sfnt_off00005e3b.bin
a8b4b91de651c273abc8ca74be4fdbd92568f250543a148279a2d6478e51b6ae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E3B 19160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.