Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd7b0722bf0d6308…

MALICIOUS

PDF

42.3 KB Created: 2021-05-12 07:32:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 4d1897422a1ebe0f9e87683138567afc SHA-1: a3c5625b2cc5413d0672be7525268e7704add8ee SHA-256: cd7b0722bf0d630814cffa882fc2a584cbd2d4f43e59a08d5207fd86ad8a4c42
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains multiple embedded URLs and a document body that attempts to lure the user into downloading game-related content, such as Roblox hacks. The heuristic 'SE_CLIPBOARD_COMMAND_LURE' indicates the document may instruct the user to execute commands, suggesting a potential for further exploitation. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE
    Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/roblox-download-game-hack
    • http://perpus.unbi.ac.id/slims7_cendana/repository/free-roblox-cards-pin-number_GM431946152.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/coin-master-hack-xyz_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana//repository/minecraft-wurst-hacked-client_GM479516143.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/how-to-get-real-robux_GM431946152.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/how-can-i-get-free-coinsn-coin-master_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/how-to-get-free-robux-without-doing-anything_GM431946152.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/coin-master-hack-2021-ios_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana//repository/play-full-version-of-minecraft-for-free-no-download_GM479516143.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/coin-master-hacks-for-pet-food_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana//repository/roblox-install-free_GM431946152.pdf
    • http://perpus.unbi.ac.id/slims7_cendana//repository/how-to-hack-a-roblox-account-2021_GM431946152.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/coin-master-hack-2021-without-verification_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/minecraft-apk-114-4_GM479516143.pdf
    • http://perpus.unbi.ac.id/slims7_cendana//repository/coin-master-3533-android-hack_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/free-coin-master-spins-link-download_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/worst-roblox-avatars_GM431946152.pdf
    • http://perpus.unbi.ac.id/slims7_cendana/repository/minecraft-free-no-virus_GM479516143.pdf
    • http://perpus.unbi.ac.id/slims7_cendana//repository/www-coin-master-hack_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana//repository/mosttechs-coin-master-free-spins_GM406889139.pdf
    • http://perpus.unbi.ac.id/slims7_cendana//repository/how-to-get-free-hair-in-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bbb.bin
ea6007658dfe7b0682078f45109b3320954c8f74253df6e87aa1ccf59745a0fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BBB 23868 bytes
font_01_sfnt_off000081fe.bin
21b28ace4d932993d49d3193db8b098f0f06cc97e3b5056ef7549ebd787d2b01		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81FE 18520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.