Malicious PDF — malware analysis report

Static analysis result for SHA-256 84e4b46ca2495b08…

MALICIOUS

PDF

49.9 KB Created: 2021-05-13 01:30:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 6708c08ba08393480083b2b2f0b26a3f SHA-1: cdb7ad61ae8c84d874cd9e7ed8156212c57b5578 SHA-256: 84e4b46ca2495b086d03015a5688eaac2bbffd63dabf096fd4d73ecbf0a29ddf
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains a lure related to obtaining free Robux, a common theme in online scams. It includes an external URI pointing to a suspicious domain, likely intended to deliver a malicious payload or redirect to a phishing site. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9349

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-get-robux-for-free-2021-game-hack
    • http://pustaka.stikesperintis.ac.id/repository/hack-coin-master-free_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/how-to-get-800-robux-for-free_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/ways-to-earn-robux_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/master-coins-free_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-free-fire_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/roblox-studio-free_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/how-to-get-free-robux-no-verification_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/robux-free-online_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/get-free-robux-gg_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-spin-rewards_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/free-roblox-gift-card-codes_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/how-to-get-free-skins-in-minecraft_GM479516143.pdf
    • http://pustaka.stikesperintis.ac.id/repository/how-to-hack-roblox-passwords_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-game-hack-apk_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/link-for-free-spins-on-coin-master_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/coin-master-free-rare-cards_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/free-robux-gift-card-codes_GM431946152.pdf
    • http://pustaka.stikesperintis.ac.id/repository/download-coin-master-apk-hack_GM406889139.pdf
    • http://pustaka.stikesperintis.ac.id/repository/pop-slots-free-vegas-casino-slots-machine-game-coin-master_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004b12.bin
5948df7ff8880a3418d14cfe6a53412d3b537aff91c3961e0de18d51675e7348		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4B12 32188 bytes
font_01_sfnt_off000095d4.bin
77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x95D4 2832 bytes
font_02_sfnt_off00009f85.bin
65f445f0396e54760dd2a1edc1744209422bc48f29c35ea74a9bcb72e79f8b06		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F85 18684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.