Malicious PDF — malware analysis report

Static analysis result for SHA-256 b8b3eac88b0892e2…

MALICIOUS

PDF

40.4 KB Created: 2021-05-21 01:06:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: feec96857c1760c1e63fe4d7cc529380 SHA-1: 56c14ce1101a7a93bc06d392f361f26fc0134354 SHA-256: b8b3eac88b0892e22c398c11db6566b070b1bc692f3d52b7cf5de1aaf4f41475
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains lures for 'Free Robux' and impersonates Facebook, directing users to a malicious URL. The ML classifier also flagged the PDF as malicious. The embedded URLs suggest an attempt to trick users into visiting potentially malicious sites, likely for credential harvesting or further malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.7770

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://netcdn.xyz/app/431946152/free-robux-not-fake-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-not-fake-game-hack PDF link annotation
    • https://new-era.com.tw/image/data/files/minecraft-launcher-free_GM479516143.pdfIn PDF document text
    • http://new-era.com.tw/image/data/files/coin-master-free-gifts_GM406889139.pdfIn PDF document text
    • http://new-era.com.tw/image/data/files/how-to-get-free-robux-easy-hack_GM431946152.pdfIn PDF document text
    • http://new-era.com.tw/image/data/files/free-robux-no-email_GM431946152.pdfIn PDF document text
    • http://new-era.com.tw/image/data/files/coin-master-hack-2021-without-verification_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000351f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x351F 24992 bytes
SHA-256: 173092b1b8ba26e3cc2e409a90dd7cd16d34255468e2b3e42f41bbb7c01f207e
font_01_sfnt_off00006e97.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E97 5696 bytes
SHA-256: 450e3ee45915afe13702bf1d587eb8b9ad88a8d2113419ac9f2fd116a828e139
font_02_sfnt_off00007ba9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7BA9 18516 bytes
SHA-256: ca79d80576681ece98af22104654f282f19bfdcccdd95bbb76316d29f9029162

Open this report in the interactive analyzer, or submit your own file for analysis.