Malicious PDF — malware analysis report

Static analysis result for SHA-256 b2df6ea209aa547e…

MALICIOUS

PDF

45.3 KB Created: 2021-06-04 04:02:51 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: ac781a9e4e4453109183aa25d44f2713 SHA-1: c51ab6a1f0ade53624c5f98662a9c91cd0d6580a SHA-256: b2df6ea209aa547e6b6b55a04129426790fd8c7484e16da400f91053505f5037
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a lure for free Robux, a virtual currency, and includes an external URI pointing to a potential download. The document body, though heavily obfuscated, contains references to 'free Robux' and a URL that likely leads to a malicious payload. The presence of embedded URLs and the ML classifier's high confidence score indicate a malicious intent to trick users into downloading further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9864

Heuristics 5

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.online/app/431946152/free-robux-no-verification-2021-android-game-hack
    • http://lib.smklabor.sch.id/repository/how-to-get-free-robux-codes-2021_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/get-free-robux-today_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/get-free-spins-for-coin-master_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/minecraft-pvp-hacks_GM479516143.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-hack-no-verify_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/how-to-get-free-gold-cards-on-coin-master_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/how-to-get-free-robux-without-verification_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-free-cards-link_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-free-spins-and-coins-daily-links_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-reward-link_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/buy-robux-free_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/links-to-get-free-coins-in-coin-master_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/coin-master-free-400-spin-link_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/free-robux-no-generator_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/roblox-rape_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/minecraft-free-online-unblocked_GM479516143.pdf
    • http://lib.smklabor.sch.id/repository/how-to-get-free-cards-sets-for-coin-master_GM406889139.pdf
    • http://lib.smklabor.sch.id/repository/bux-life-free-robux_GM431946152.pdf
    • http://lib.smklabor.sch.id/repository/free-coin-master-spins_GM406889139.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00005202.bin
64fbfc00858b2c640aa915029c934b5f2119f53f9eef404d4c290fe6cb727ce0		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x5202 25132 bytes
font_01_sfnt_off00008bdc.bin
2db8195158682863467aa5049c27493158ce29af4e73d213a7d216c5b0c72741		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BDC 19176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.