Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b319f466eb77726…

MALICIOUS

PDF

34.9 KB Created: 2021-07-05 18:36:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 68628cebd150a2d93b13552dd7e887a0 SHA-1: 6d4225b7fe008cbb5e63c990eebd88caf40656fc SHA-256: 9b319f466eb777266d53518416f9f8e9511273bbf822caabe0cd7f5cecd57380
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains numerous embedded URLs pointing to sites offering 'free Roblox executors' and 'hacks', indicating a phishing or scam attempt to trick users into downloading potentially malicious software. The ML classifier strongly flagged this PDF as malicious, and the presence of multiple download-related lures reinforces this assessment. No scripts were extracted, but the document's primary function appears to be directing users to external malicious resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/free-roblox-executor-no-key-game-hack
    • http://smpn1sda.sch.id/slims/repository/roblox-no-download-hack_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/item20212021-free-roblox_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/hack-roblox-click-tp_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/money-hack-roblox-jailbreak_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/promo-codes-for-free-robux_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/cool-tshirts-for-free-roblox_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/roblox-money-hack_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/how-to-get-hacked-accounts-back-on-roblox_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/free-roblox-followers-generator_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/roblox-free-robux-hack-no-human-verification_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/free-roblox-clothes_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/lootbux-free-robux_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/drag-hack-roblox_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/links-to-get-free-coins-in-coin-master_GM406889139.pdf
    • http://smpn1sda.sch.id/slims/repository/hack-to-get-money-on-roblox-rocitizens_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/coin-master-link-today_GM406889139.pdf
    • http://smpn1sda.sch.id/slims/repository/bux-gg-free-robux-without-human-verification_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/roblox-treasure-hunt-simulator-hack-script_GM431946152.pdf
    • http://smpn1sda.sch.id/slims/repository/how-to-get-free-robux-2021_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003058.bin
87b3a7879ac672426aade86b14e062820d49399c6e49984abb4ce0315216a61c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3058 22780 bytes
font_01_sfnt_off00006348.bin
a3655b6835e0c341634604fe14b5aa8dd34c828a46700e4c83960d8902ba3df5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6348 19072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.