Malicious PDF — malware analysis report

Static analysis result for SHA-256 99e10634e4ba3c40…

MALICIOUS

PDF

44.3 KB Created: 2021-04-28 16:17:37 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-17
MD5: 73ac23a91fd75d19a321162ec0e597b5 SHA-1: 364f8ba140e0270445e9e1239045d2d7490d9b7d SHA-256: 99e10634e4ba3c40ec5714fde5bac8cb37f4bd05ee5071512a4139b21e53725c
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF document employs social engineering tactics by luring users with promises of free Robux and game hacks. It directs users to external URLs and prompts them to install browser extensions or updates, a common method for malware delivery or credential theft. The ML classifier strongly indicated maliciousness, and the embedded URLs suggest a phishing or scam attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9868

Heuristics 5

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-generator-no-scams-no-verification-game-hack PDF link annotation
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/where-to-get-free-clothes-on-roblox.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-to-use-cheat-engine-on-roblox-2021-august.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/how-can-i-get-free-robux.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/aimbot-for-roblox-free-for-all.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/comment-faire-si-on-a-ete-hack-sur-roblox.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/free-robux-no-robot-verification.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/roblox-jailbreak-free-vip-server-link-in-the-desc.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/hack-roblox-servers.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/change-roblox-username-pastebin-free.pdfIn PDF document text
    • http://www.nlcitychurch.org.hk/upload/userfiles/files/shark-hacks-roblox.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000435f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x435F 26764 bytes
SHA-256: edae9eee0a3b4bed0ce83869e487cca1c5f0a37860da8bfea96019839031fef2
font_01_sfnt_off00007ff8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7FF8 2832 bytes
SHA-256: 77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2
font_02_sfnt_off000089a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x89A9 18860 bytes
SHA-256: 687cfa3b03dbde9128f805f6c2b506c67e8e468c71de973c9897d91177102a9b

Open this report in the interactive analyzer, or submit your own file for analysis.