Malicious PDF — malware analysis report

Static analysis result for SHA-256 b92e0d5e5353a5ac…

MALICIOUS

PDF

48.6 KB Created: 2021-05-01 12:16:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 139c3f294a022a0769b2f0e7c9dbcce4 SHA-1: c22b078444920b2306fb34b2250dc702070cec8b SHA-256: b92e0d5e5353a5aca8fb03c453700d44488ee86458ef85e508aa143d4ccecbe8
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains multiple embedded URLs and a lure related to 'free Robux' and hacking, which is a common social engineering tactic. The heuristic 'SE_PAYMENT_REDIRECT_LURE' indicates a pattern often seen in business email compromise attacks, suggesting the document aims to trick users into fraudulent transactions or credential theft. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9764

Heuristics 4

  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/how-to-hack-for-roblox-game-hack PDF link annotation
    • https://fridaytravelnepal.com/userfiles/files/free-robux-geerator.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/free-2021-account-roblox.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/free-robux-just-enter-username-and-password.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/generator-hack-roblox-online-pc.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/claim-free-robux-instantly.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/how-to-get-free-robux-no-human-verification-2021-ipad.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/hack-pour-avoir-des-robux.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-free-girl-body.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-counter-blox-roblox-offensive-hack-2021.pdfIn PDF document text
    • https://fridaytravelnepal.com/userfiles/files/roblox-tool-hack-download.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000044f0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x44F0 26164 bytes
SHA-256: 68b9601b0829f52a40d59b3393c3ab6ba38a6975aeca07798769a4d864213827
font_01_sfnt_off000080b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x80B4 11440 bytes
SHA-256: 154d59d1680f2d1e38ccb783d6997f344290d121007e51df331726de4128c12e
font_02_sfnt_off00009bd4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9BD4 18512 bytes
SHA-256: f52fe1434e26f04e7ae4b51b4625b55e28a2b0b89f8d0ba6458076490d40f88f

Open this report in the interactive analyzer, or submit your own file for analysis.