Malicious PDF — malware analysis report

Static analysis result for SHA-256 b763c4f75edc1249…

MALICIOUS

PDF

34.7 KB Created: 2021-06-18 06:09:12 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 86b8e8269e795c4592d9563ed45b39ad SHA-1: 1e64a105161d6dc6e9d6ebf328c0b5f10bb7adad SHA-256: b763c4f75edc12491af948401d4903e6be7126f3d3c35693a19e3bef77d76001
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The document contains multiple embedded URLs and a prominent link in the body text, all related to game hacks and exploits, suggesting a lure to download potentially malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the conclusion that it is designed to trick users into executing further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-hack-vehicle-simulator-roblox-game-hack
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/distork-free-robux-generator_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/get-free-robux-no-human-verification_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-robux-hacker-us_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-outfits-roblox-names_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-to-hack-denis-roblox-account_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-games-to-play-for-free_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/code-cheater-unboxing-simulator-roblox_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-robux-needs-password_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/minecraft-fly-hack_GM479516143.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-mods-for-minecraft-pe_GM479516143.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-robux-hack-generator-2021_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-1x1x1x1-hack-crazy_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-free-robux_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/hacks-in-roblox-jailbreak-2021_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-2021_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-tiktok-followers-instantly_GM835599320.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/get-free-robux-generator_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-to-get-free-roblox-codes-2021_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/demon-hack-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f50.bin
74e37351d4f29a0b27d3b8e36ff29eac307d1869781f2d0a57742923eb81e450		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F50 22176 bytes
font_01_sfnt_off00006080.bin
b8f9d6fd9e3aaf3153c8a9ec7ed047a9c131e97ca7a43af3213d1da42eceabfc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6080 19744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.