PDF malware analysis — malicious · b0a54c81f6439a38

MALICIOUS

PDF

47.1 KB Created: 2021-06-02 18:38:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: be8987193c1620af7e80b621f5d8306a SHA-1: d4a6cf8c74b0f75a8584c41eca9daab1f0eade5b SHA-256: b0a54c81f6439a38fa61085d630ce859d88e8caf8d6bbe469a65946ccf2c6e79

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell T1203 Exploitation for Client Execution

The PDF document contains embedded URLs and a lure to execute commands via the clipboard, strongly suggesting it's designed to trick users into downloading and running malicious content. The ML classifier also flagged this PDF as malicious. The document body, though partially corrupted, contains references to 'Roblox Command Prompt Hack' and a URL, reinforcing the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9769

Heuristics 4

Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/roblox-command-prompt-hack-game-hack
- http://www.art-concept.gr/images/roblox-phantom-forces-hack_GM431946152.pdf
- http://www.art-concept.gr/images/coin-master-twitter_GM406889139.pdf
- http://www.art-concept.gr/images/coin-master-unlimited-spin-link_GM406889139.pdf
- http://www.art-concept.gr/images/coin-master-hacks_GM406889139.pdf
- http://www.art-concept.gr/images/free-robux-group-payouts_GM431946152.pdf
- http://www.art-concept.gr/images/free-coin-master-spins-hack_GM406889139.pdf
- https://art-concept.gr/images/minecraft-realms-free-trial_GM479516143.pdf
- https://art-concept.gr/images/earn-free-robux-for-roblox-robloxwin_GM431946152.pdf
- http://www.art-concept.gr/images/free-coin-master-cards_GM406889139.pdf
- http://www.art-concept.gr/images/free-spins-for-coin-masters_GM406889139.pdf
- http://www.art-concept.gr/images/coin-master-heaven-free-spins_GM406889139.pdf
- http://www.art-concept.gr/images/hack-coin-master-spin-apk_GM406889139.pdf
- http://www.art-concept.gr/images/tryrbx-site-free-robux_GM431946152.pdf
- http://www.art-concept.gr/images/how-do-you-get-free-robux-2021_GM431946152.pdf
- http://www.art-concept.gr/images/free-robux-generator-no-verification-2021_GM431946152.pdf
- http://www.art-concept.gr/images/free-robux-glitch_GM431946152.pdf
- https://art-concept.gr/images/free-robux-no-human-verification-2021_GM431946152.pdf
- http://www.art-concept.gr/images/www-free-robux-com_GM431946152.pdf
- http://www.art-concept.gr/images/coin-master-free-spins-2021-blogspot_GM406889139.pdf
- http://www.art-concept.gr/images/free-spin-app-coin-master_GM406889139.pdf
- https://www.bandicam.com
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00004f5c.bin` `bef1728da0682270bad8aed29856a5a573112aad0ec6c2843243ed2aa4577a1b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4F5C	24916 bytes
`font_01_sfnt_off0000894d.bin` `d88f25cfe237a714f996150a11dd8a058f0f7c3e9d1ae91c17b46c10409b6c0b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x894D	2820 bytes
`font_02_sfnt_off000092e8.bin` `7f44f70fc8d073c022a3e0815a54a67b89d74b825034e2de5ba64c75b48ddeb4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x92E8	19048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.