Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2c6378a4646d3fd…

MALICIOUS

PDF

34.9 KB Created: 2021-06-29 07:18:41 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 003a4ccad2f83059445189fa853375be SHA-1: d438ab846d3e5b2d0d45f30e82af85e2c2365da9 SHA-256: b2c6378a4646d3fd5ed1705864cad8bfa54f7ac7ebe26ae32ce348cfa04f81d7
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded URLs and a document body that advertises hacks and cheats for the game Roblox, aiming to trick users into downloading malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs further supports a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-vampire-hunters-2-hack-game-hack
    • http://e-pustaka.stkipadzkia.ac.id/repository/roblox-cheat-ninja-legend_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/roblox-meep-city-10-000-cheats_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/how-to-cheat-in-leavels-booga-booga-roblox_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/free-robux-valid-codes-2021_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/private-servers-free-roblox_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/maps-to-hack-roblox_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/free-robux-no-verify_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/invited-free-robux-glitch-by-unknown_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/how-can-i-get-robux_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/roblox-polyguns-hack_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/roblox-its-free-2021_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/free-printable-coloring-page-roblox_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/free-robux-websites-no-human-verification_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/claimrbx-free-robux_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/hack-de-vida-infinita-roblox_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/roblox-800-free-robux_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/how-to-install-free-song-to-roblox_GM431946152.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/coin-master-daily-free-spins-link-today_GM406889139.pdf
    • http://e-pustaka.stkipadzkia.ac.id/repository/free-coins-coin-master-hack_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fff.bin
6b508af17bcc2e62192974b9118354238b3d1c2ce8060d827448da8eacacfb76		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FFF 22112 bytes
font_01_sfnt_off0000613b.bin
d4423a906331ba353b91e1849c35783308bb34dc4bcc89731f6c2ad2b691fd63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x613B 19712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.