Malicious PDF — malware analysis report

Static analysis result for SHA-256 be7e33794dcdaa42…

MALICIOUS

PDF

46.9 KB Created: 2021-07-04 13:00:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-18
MD5: 5e2fc0226f2d8118144e58aa7de8c0dc SHA-1: 671e39d7603fba98fd6fb9bb487a70044c3ccc35 SHA-256: be7e33794dcdaa42f4437023258d90747c736ae2b491c642f8859fb3a579f70a
124 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are disguised as 'free Robux' or 'game hack' resources. The ML classifier strongly identified this PDF as malicious, and heuristics indicate it redirects users to potentially harmful content. The presence of a polyglot child PDF further suggests an attempt to conceal malicious functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 6

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Secondary embedded PDF body has suspicious static findings high POLYGLOT_CHILD_PDF_STATIC_TRIAGE
    A valid PDF body was found at a nonzero offset inside another container and its carved contents matched PDF exploit or lure heuristics. This catches polyglots where the top-level magic routes to ZIP/OLE while a PDF reader or downstream parser opens the hidden PDF payload.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/431946152/best-free-robux-sites-game-hack PDF link annotation
    • http://perpus.polimarim.online/repository/to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/websites-that-give-you-free-robux_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/roblox-hacks-fo-building-on-bloxburg-site-youtubecom_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/hack-roblox-admin-dl_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/free-robux-no-verification-or-survey_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/roblox-free-bundles_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/roblox-jail-break-how-to-get-the-lamborughni-for-free_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/roblox-report-hacker_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/get-free-stuff-roblox-gear_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/coin-master-free-spins-link-download-hack_GM406889139.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/free-robux-invite_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/free-robux-without-verification_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/minecraft-pvp-hacks_GM479516143.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/robux-website_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/roblox-cheat-codes-vehicle-simulator_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/roblox-jailbreak-hack-download_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/half-guest-and-noob-roblox-free_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/como-ser-hacker-en-roblox-en-movil_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/i-want-to-break-free-roblox-versin_GM431946152.pdfIn PDF document text
    • http://perpus.polimarim.online/repository/how-to-get-hacks-on-roblox-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000633d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x633D 21848 bytes
SHA-256: 3a9e4eb515d8430844735f77c7c2801249e158f47b74154dab81b5c60a4abede
font_01_sfnt_off000093ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x93AC 18940 bytes
SHA-256: 0fcca8ab5ad8a611b3094f34fe9520b7837fa4f9a56d425283eb336eaeb68af3
polyglot_child_pdf_off000034c0.pdf polyglot-child-pdf Secondary PDF body inside pdf container at offset 0x34C0 34524 bytes
SHA-256: e52173b4fa043c26c466130fea55eee80341c668558d9ef9e6e40f2fbdf6cf4d

Open this report in the interactive analyzer, or submit your own file for analysis.