Malicious PDF — malware analysis report

Static analysis result for SHA-256 96f5fb9babdf74e8…

MALICIOUS

PDF

35.8 KB Created: 2021-06-25 22:26:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 581d0e45f247666c8c8b9d976069ed98 SHA-1: 8b80b059d37c3c88a3a4f8482612e7fea83d926d SHA-256: 96f5fb9babdf74e84a7dc2d7bc72e05f9675773a39f827f0983643ba0930f6d7
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains numerous invisible links that lead to websites offering game cheats and generators, such as 'free-robux-generator-no-survey-or-captcha'. The presence of these lures, combined with the ML classifier flagging it as malicious, strongly suggests a phishing or malware distribution attempt. The document's content and structure are designed to deceive users into clicking these links, likely leading to a second-stage download or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
    PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-grand-blox-auto-money-cheat-game-hack
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/free-stuff-on-roblox_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/roblox-com-free-robux-hack_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/minecraft-realms-free-codes_GM479516143.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/free-shavaco-do-song-code-for-roblox_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/free-robux-generator-no-survey-or-captcha_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/how-to-get-free-sounds-on-roblox_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/roblox-lost-game-hack-script_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/roblox-arsenal-hacks-download_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/free-gift-card-generator-roblox_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/free-spins-and-coins-on-coin-master_GM406889139.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/roblox-terminal-railway-admin-train-cheat_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/assassin-2-hack-roblox_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/free-robux-that-actually-works-2021_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/minecraft-hacks_GM479516143.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/roblox-hunter-x-hunter-lvl-hack_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/aimbot-hack-roblox-murder-mystery-2_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/kidnap-cheat-roblox_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/fly-hack-roblox-no-cheat-engine-any-games_GM431946152.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/minecraft-windows-10-edition-unlock-full-game-free_GM479516143.pdf
    • http://perpustakaan.fksb.unismabekasi.ac.id/katalog-buku/repository/roblox-land-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000327d.bin
d8a0355b0420a0991288ecd70bdc92cc7307f089bd5dd1bdd2e25f0fb566a0cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x327D 23160 bytes
font_01_sfnt_off000065dd.bin
d6669bd47a77c6b7c0fcc2047b318829d91d10c03e975e2ec188c8229a0f1143		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65DD 19444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.