Malicious PDF — malware analysis report

Static analysis result for SHA-256 91e238eff36bf0bd…

MALICIOUS

PDF

45.9 KB Created: 2021-06-01 02:12:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: c769b1c8f82320d7b6b2878c2382f7ea SHA-1: 99b6f130b5dec7f1d9b3fc29205e9cfa9638a174 SHA-256: 91e238eff36bf0bd43c8e0f7658b16d8328e63e8bc3d00415e65fe6b52cdcdc5
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains embedded URLs and heuristics indicating it is malicious, likely serving as a lure for downloading further content. The presence of an MFA lure suggests an attempt to harvest credentials or session tokens. The document body, though heavily corrupted, contains references to game cheats and a URL that further supports this malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 4

  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-prison-break-cheats-game-hack PDF link annotation
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/how-to-buy-robux-for-free_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/redeem-hack-roblox-2021-robux_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/get-free-robux-2021_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/how-to-get-free-robux-without-doing-anything_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/minecraft-free-online-games_GM479516143.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/minecraft-java-edition-free-trial_GM479516143.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/minecraft-build-hacks_GM479516143.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/free-long-hair-roblox_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/get-tiktok-followers-free_GM835599320.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/free-robux-gift-card-codes-2021_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/how-to-create-a-minecraft-server-for-free_GM479516143.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/free-robux-easy_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/coin-master-free-gifts_GM406889139.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/coin-master-spin-free_GM406889139.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/free-coin-master-spins-and-coins_GM406889139.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/mad-city-roblox-cheat-synapse_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/how-to-get-free-robux-on-roblox-2021-no-hacks_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/is-minecraft-bedrock-edition-free_GM479516143.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/roblox-hack-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • https://forensicsinstitute.org/wp-content/uploads/fsqm-files/how-can-i-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005027.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5027 28636 bytes
SHA-256: b4fddd8cc681a49774143e7b384a38229a33a227e22e47676a197a041f7745d9
font_01_sfnt_off00008f99.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8F99 18728 bytes
SHA-256: f9ab0c75e852c4c69463f251d574ee6fcbaf0a4fbea32cc876db63220f7888fe

Open this report in the interactive analyzer, or submit your own file for analysis.