Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6b67b366e2306a8…

MALICIOUS

PDF

34.7 KB Created: 2021-07-03 20:03:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: ca98bc6201666fcb93518f7d11b85abf SHA-1: 24f46bb3ad77a1c8b57bbad50e93282968c7f8e9 SHA-256: c6b67b366e2306a8bd0fb3ab126a94e6b28b026e5f946aa803e7973ba2554f37
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains multiple invisible links and visual cues designed to trick the user into clicking through to external websites. The lures, such as '100 Free Spins Coin Master' and 'free robux', are common social engineering tactics. The embedded URLs point to sites that likely host further malicious content or phishing pages, aiming to exploit the user's desire for in-game items or currency.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
    PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.tw/app/406889139/100-free-spins-coin-master-game-hack PDF link annotation
    • http://elib-s2.ubl.ac.id/repository/roblox-report-hacker_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/shark-bite-roblox-cheat_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/free-tiktok-followers-generator_GM835599320.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/roblox-free-view-camera_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/robux-page-free_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/free-robux-with-recapcha_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/free-robux-2021_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/roblox-how-to-get-free-clothes-on-phone_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/roblox-free-set_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/free-minecraft-maps_GM479516143.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/how-to-hack-roblox-accounts-with-cookie-venom_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/free-robux-no-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/roblox-rc7-apocalypse-rising-hack-scripts_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/free-robux-codes-2021-october_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/ninja-zone-hacks-roblox_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/hack-matar-gente-roblox_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/how-to-hack-robux-using-javascript_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/how-to-get-free-robux-without-verifying-2021_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/how-to-get-free-robux-2021-to-2021_GM431946152.pdfIn PDF document text
    • http://elib-s2.ubl.ac.id/repository/new-roblox-hack-script_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003140.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3140 22944 bytes
SHA-256: 9ba4c2b9db730a7074b425b7eb9d0eb14a02beb66fcc67403be3e6948467f23b
font_01_sfnt_off0000649e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x649E 18452 bytes
SHA-256: d0c04ff51ad59f6355ad4f24aeb86ad145506544650f67de66568f082738138f

Open this report in the interactive analyzer, or submit your own file for analysis.