Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdac89c1948cc6c1…

MALICIOUS

PDF

35.3 KB Created: 2021-06-19 05:26:00 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 2f69584ec8a2d889aca2b883f2513e67 SHA-1: ac09c851e7f16eac75332e3aea307464c31ec1bd SHA-256: cdac89c1948cc6c12258824a7f7b2c9bbafd5a4b508be4e1f983366ac9fb9041
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The document contains multiple URLs pointing to sites offering free Robux or game hacks, a common lure for malware distribution. The presence of a 'password-protected archive' heuristic suggests the document may be a precursor to downloading an encrypted payload. The ML classifier strongly indicates maliciousness, and the document body reinforces the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-become-hypebeast-in-roblox-for-free-game-hack
    • http://library.ft.upnvj.ac.id/repository/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/no-scam-free-robux_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/free-robux-working_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/microsoft-bing-free-robux_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/how-to-get-free-robux-on-roblox_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/free-printable-minecraft-coloring-pages_GM479516143.pdf
    • http://library.ft.upnvj.ac.id/repository/free-robux-picture_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/coin-master-link-spin_GM406889139.pdf
    • http://library.ft.upnvj.ac.id/repository/coin-master-hack-version-2021-free-download_GM406889139.pdf
    • http://library.ft.upnvj.ac.id/repository/robuxmatchcon_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/heroes-online-roblox_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/free-games-like-minecraft_GM479516143.pdf
    • http://library.ft.upnvj.ac.id/repository/how-to-get-free-robux-on-roblox-2021_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/free-robux-no-password_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/hack-coin-master-mod-apk_GM406889139.pdf
    • http://library.ft.upnvj.ac.id/repository/coin-master-free-spins-cheats_GM406889139.pdf
    • http://library.ft.upnvj.ac.id/repository/free-robux-live_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/free-spin-in-coin-master_GM406889139.pdf
    • http://library.ft.upnvj.ac.id/repository/free-robux-hacker-us_GM431946152.pdf
    • http://library.ft.upnvj.ac.id/repository/get-me-robux-for-free_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003072.bin
ea43c2a1ce54768894c069816728d76b5fba3149b4ccd3b8f3a09662c380f18f		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3072 22772 bytes
font_01_sfnt_off00006384.bin
a9939601a6913cf8ce4b535bfb1166251da597504f308aa5e97d8e8a8dc182b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6384 19532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.