Malicious PDF — malware analysis report

Static analysis result for SHA-256 d156f5b2d9c82e9a…

MALICIOUS

PDF

40.6 KB Created: 2021-04-29 02:54:32 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: 3da8b03be1ada491a9957eb6e138281b SHA-1: 5f2e47ef18d81a0030cbd8366d683adc9101c701 SHA-256: d156f5b2d9c82e9a4ded7f7fb61830837be9ee7f58bc3a798214930aa2e78421
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document uses social engineering tactics, impersonating Facebook to trick users into clicking a malicious link. This link, hosted on `netcdn.xyz`, is presented as a download for free Roblox game hacks, but the heuristic firings indicate it's a lure for installing browser extensions or updates. The presence of multiple PDF_URI and EMBEDDED_URL findings further supports the malicious intent of directing users to external, potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 6

  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://netcdn.xyz/app/431946152/best-shirt-roblox-free-game-hack.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/best-shirt-roblox-free-game-hack PDF link annotation
    • https://lib.stie-yai.ac.id/repository/free-robux-promo-code-generator-2021.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/free-robux-without-scams.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/robloxgiveaway-xyz-free-robux.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/free-working-2021-roblox-aim-aimbot.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/free-promo-codes-roblox-group.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/how-to-get-free-robux-creag.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/obby-gives-you-free-robux-no-password-required.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/critical-strike-hacks-roblox.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/how-to-use-roblox-hacks.pdfIn PDF document text
    • https://lib.stie-yai.ac.id/repository/how-do-you-get-free-robux-easy-way.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off000042fc.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x42FC 25100 bytes
SHA-256: fd0de2e2c5bbce5a7052ee625914805ab6b4ffda59ea5c050cd1a3d8e6cfd2ce
font_01_sfnt_off00007cf5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7CF5 18340 bytes
SHA-256: 5152868e15e6095293020136fd95d2a58e8e1224bcabecc81bfe8f8a5155026d

Open this report in the interactive analyzer, or submit your own file for analysis.