Malicious PDF — malware analysis report

Static analysis result for SHA-256 c292f978c1ad95e5…

MALICIOUS

PDF

41.1 KB Created: 2021-05-22 20:41:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 6b121f25f2fed88a05fee0f0b48491d5 SHA-1: c8918e3543e7b749165adc23722f26b102e119ae SHA-256: c292f978c1ad95e5d806a772748d31d772dca6648b36bccef26c8a6950b93187
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript T1203 Exploitation for Client Execution

The PDF document contains multiple embedded URLs, one of which is associated with a brand-impersonation credential phishing lure for "Roblox Generator". The ML classifier also flagged this PDF as malicious. The presence of embedded JavaScript and the nature of the lure suggest an attempt to trick the user into downloading a second-stage payload or providing sensitive information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9476

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://netcdn.xyz/app/431946152/is-there-a-way-to-get-free-robux-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/is-there-a-way-to-get-free-robux-game-hack PDF link annotation
    • https://leechan.cn/Public/upload/editorfiles/how-to-get-minecraft-for-free-on-chromebook_GM479516143.pdfIn PDF document text
    • https://leechan.cn/Public/upload/editorfiles/hack-version-of-coin-master-apk-download_GM406889139.pdfIn PDF document text
    • https://leechan.cn/Public/upload/editorfiles/free-robux-only-username-no-human-verification_GM431946152.pdfIn PDF document text
    • https://leechan.cn/Public/upload/editorfiles/httpswwwurcouponsdealcom202103coinmasterfreespinandcoinlinkshtml_GM406889139.pdfIn PDF document text
    • https://leechan.cn/Public/upload/editorfiles/coin-master-free-spins-link-cheat_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000351e.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x351E 33312 bytes
SHA-256: 3ecb07315a92e435ad4e1d1d0721a367578f672249e686cc885b6b0cbe8b32a5
font_01_sfnt_off00007def.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7DEF 18892 bytes
SHA-256: e2ca2daecae93cd27ff1d51a172310d30bada5b25af9f9600d3ad780ee102f76

Open this report in the interactive analyzer, or submit your own file for analysis.