PDF malware analysis — malicious · ce20bd784b32fac0

MALICIOUS

PDF

33.7 KB Created: 2021-06-19 02:49:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 155390c1b6ca9cf1353ca6d58edb722c SHA-1: 0f73bba4ea2a6ba8cac99d96f4c0674a63c1435c SHA-256: ce20bd784b32fac0d14e76af62bf721d0a73f406aa3cd28c16f798f0303d75b1

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded URLs and a call-to-action phrase, strongly suggesting a phishing or social engineering attempt to trick users into downloading malicious content. The ML classifier also flagged this PDF as malicious with high confidence. The document body and heuristics indicate the lure is related to "hack scripts" for games like Roblox, aiming to exploit user interest in obtaining in-game currency or advantages.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND

Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/hack-script-roblox-game-hack
- http://fishboat.hr/files/how-to-get-free-robux-hack-2021_GM431946152.pdf
- https://www.fishboat.hr/files/how-to-get-free-robux-com_GM431946152.pdf
- https://www.fishboat.hr/files/free-minecraft-videos_GM479516143.pdf
- https://www.fishboat.hr/files/make-free-robux_GM431946152.pdf
- http://fishboat.hr/files/pokemon-go-free-evolve-with-trade_GM1094591345.pdf
- https://www.fishboat.hr/files/coin-master-free-soins_GM406889139.pdf
- http://fishboat.hr/files/free-robux-master_GM431946152.pdf
- https://www.fishboat.hr/files/do-new-roblox-playe4e-get-robux-for-free_GM431946152.pdf
- http://fishboat.hr/files/roblox-hack-client_GM431946152.pdf
- https://www.fishboat.hr/files/coin-master-free-spin-link-today-2021_GM406889139.pdf
- https://www.fishboat.hr/files/minecraft-pocket-apk_GM479516143.pdf
- https://www.fishboat.hr/files/how-to-earn-free-robux_GM431946152.pdf
- http://fishboat.hr/files/roblox-hack-nopde-engine_GM431946152.pdf
- http://fishboat.hr/files/robux-match_GM431946152.pdf
- http://fishboat.hr/files/free-cmds-in-roblox_GM431946152.pdf
- http://fishboat.hr/files/robux-for-surveys_GM431946152.pdf
- https://www.fishboat.hr/files/free-robux-easy-for-kids-fof-noobs_GM431946152.pdf
- http://fishboat.hr/files/free-robux-clothes_GM431946152.pdf
- https://www.fishboat.hr/files/free-promo-codes-roblox_GM431946152.pdf
- http://fishboat.hr/files/coin-master-game-download-free_GM406889139.pdf
- http://fishboat.hr/files/robu
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002cb7.bin` `a878e8b2d4cf95e24101a33627b301ca45265931bc32a8a858ba28664382bc61`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2CB7	22412 bytes
`font_01_sfnt_off00005e4d.bin` `4bf314fb5acda51eb0c97b6d03b1c84cdfe76c933fd1bc32a1b130d4b2ead0cd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E4D	19056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.