Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4d28176b337f877…

MALICIOUS

PDF

34.1 KB Created: 2021-06-30 16:38:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: 37df0ac2fba6b02cf2346d91cbfe9c74 SHA-1: 9bc94964723caffa139abab7644d0e31de37d42a SHA-256: c4d28176b337f877268c0bac21479dfeafb3bb52bba56268d75e3042107e03e7
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The document impersonates brands like Facebook to lure users into clicking malicious links, likely for credential phishing or to download further malware. The primary malicious URL identified is http://netcdn.co/app/431946152/roblox-free-items-in-catalog-2021-game-hack. While no scripts were extracted, the ML classifier and brand impersonation heuristics strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: http://netcdn.co/app/431946152/roblox-free-items-in-catalog-2021-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-free-items-in-catalog-2021-game-hack PDF link annotation
    • https://www.modestuae.com/uploaded_files/userfiles/files/is-it-illegal-to-hack-in-roblox-against-a-streamer_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/instantrobux_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/robux-hack-no-human-verification-no-download-no-survey-2021_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/coin-master-spin-free_GM406889139.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/free-pe_GM479516143.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/how-to-run-faster-in-roblox-hack_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/best-free-minecraft-server-hosting_GM479516143.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/roblox-generator-com_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/promo-codes-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/roblox-welcome-to-bloxburg-money-hack-luc_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/free-spins-on-coin-master-link_GM406889139.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/how-to-prevent-hacking-on-roblox_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/featured-items-on-roblox-free_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/free-robux-melissa_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/how-can-u-get-free-robux_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/the-coin-master-hack_GM406889139.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/how-to-get-free-money-on-rocitizens-roblox_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/cool-roblox-free-outfits_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/roblox-gift-card-online-free_GM431946152.pdfIn PDF document text
    • https://www.modestuae.com/uploaded_files/userfiles/files/free-games-like-coin-master_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2F10 21676 bytes
SHA-256: 99b771411a278cad5d34aa86b4ddb274b08dcc41ca859a47f534f41d6db5095f
font_01_sfnt_off00005ef1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5EF1 19416 bytes
SHA-256: 61827fd022647c102fe3df237b009348f1c94f8840157d07a25f3c8993123e06

Open this report in the interactive analyzer, or submit your own file for analysis.