Malicious PDF — malware analysis report

Static analysis result for SHA-256 9619e25165f53255…

MALICIOUS

PDF

43.3 KB Created: 2021-06-10 17:36:43 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: f1a13a5c6e04fbb33e9325c487d59811 SHA-1: f97500ca9ba773dcfe0052de3adbf96880ba8cbe SHA-256: 9619e25165f53255f5286c97efe34675f919e51655f893609a6b94a17d7ecf16
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a high-severity heuristic indicating it links to a 'free generator / game hack' redirector, specifically pointing to a URL related to 'free Robux'. The document body also contains similar lure text and numerous related URLs, suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9969

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/power-games-free-robux-game-hack PDF link annotation
    • http://italymania.ru/images/apps-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/minecraft-free-download-pc_GM479516143.pdfIn PDF document text
    • http://italymania.ru/images/free-minecraft-coloring-pages_GM479516143.pdfIn PDF document text
    • http://italymania.ru/images/free-items-on-roblox-2021_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/free-minecraft-for-kids_GM479516143.pdfIn PDF document text
    • http://italymania.ru/images/good-hack-scripts-for-roblox_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/coin-master-2021_GM406889139.pdfIn PDF document text
    • http://italymania.ru/images/300-free-spins-coin-master_GM406889139.pdfIn PDF document text
    • http://italymania.ru/images/how-to-make-free-robux_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/free-robux-hack-us_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/free-tiktok-followers-no-survey_GM835599320.pdfIn PDF document text
    • http://italymania.ru/images/free-robux-easy_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/how-to-get-free-tiktok-fans-without-human-verification_GM835599320.pdfIn PDF document text
    • http://italymania.ru/images/roblox-speed-hack_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/coin-master-daily-free-spins-haktuts_GM406889139.pdfIn PDF document text
    • http://italymania.ru/images/how-to-get-free-robux-no-verification_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/free-robux-2021_GM431946152.pdfIn PDF document text
    • http://italymania.ru/images/coin-master-free-daily-spins-link_GM406889139.pdfIn PDF document text
    • http://italymania.ru/images/free-roblox-account-generator_GM431946152.pdfIn PDF document text
    • http://192.168.0.99/%20%3Cp%3E%3Cp%3Eroblox%20restaurant%20tycoon%20diamond%20hack%3Cp%3E%3Cp%3Ehow%20to%20hack%20roblox%20with%20tampermonkey%3Cp%3E%3Cp%3ECheck%20out%201M%20free%20Robux!.%201M%20free%20Robux!%20By%20Tennisballgolfball4.%3Cp%3E%3Cp%3Efree%20roblox%20accounts%20with%20robux%202020%3Cp%3E%3Cp%3ELinphone%20is%20an%20open%20source%20SIP%20client%20for%20HD%20voice/video%20calls,%201-to-1%20and%20group%20instant%20messaging,%20conference%20calls%20etc.%20Available%20for%20iOS,%20Android,%20Windows,%20macOS%20and%20GNU/Linux.%3Cp%3E%3Cp%3Eroblox%20free%20executor%202019%3Cp%3E%3Cp%3EGet%20To%20Know%20More%20About%20ROBLOX%20FREE%20ROBUX%20GENERATOR%20Codes%20Hack%20On%20WiseIntro%20Portfolio%20-%20Providing%20a%20Beautiful%20Website%20That%20Works%20For%20You,%20Helping%20You%20Raise%20Your%20Profile%20&%20Attract%20New%20Clients%3Cp%3E%3Cp%3Ehow%20to%20get%20free%20admin%20in%20roblox%20on%20all%20games%3Cp%3E%3Cp%3Ebuy%20roblox%20for%20free%3Cp%3E%3Cp%3Ehow%20to%20get%20free%20robux%20and%20tix%20on%20roblox%20mobile%3Cp%3E%3Cp%3EWhat%20do%20you%20use%20to%20edit%20your%20videos.%20Check%20out%20eating%20simulator%202.%20Doppler%20Hat%20Games%20Dopplerhat%20Twitter.%200%20replies%200%20retweets%200%20likes.%20Message%20us%20through%20twitter%20roblox%20or%20the%20community.%20Roblox%20weapon%20simulator.%20Collect%20coins%20to.%3Cp%3E%3Cp%3EStill%20Wondering%20How%20to%20get%20Free%20Robux%20No%20Survey%20No%20Scam%20No%20Human%20Verification%20for%20Kids.%20You%20can%20do%20virtually%20anything%20with%20Robux%20in%20Roblux%20games.%20If%20youIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004d8c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4D8C 25488 bytes
SHA-256: 2d4be41924308befb0621a07cac9e5580950600acf2b9d590834ba49185d665a
font_01_sfnt_off000086f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x86F1 18244 bytes
SHA-256: 2299db7974cfc9abab0d6ebd176c09a57c7649953618fabd1d11cce9bfa4af27