Malicious PDF — malware analysis report

Static analysis result for SHA-256 d86be1f29ef93ed5…

MALICIOUS

PDF

34.8 KB Created: 2021-06-25 16:50:48 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 901fc0fcebd39040527df0fc54e557dd SHA-1: 264cb1fe8018ba8605f890bf685bed03dcd17f98 SHA-256: d86be1f29ef93ed5b1fa9ded145370ac5f9954e69dd2090735026b38707715f9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains numerous embedded URLs and a prominent link in its body text, all related to game 'hacks' and 'free items'. This strongly suggests a lure to a malicious website, likely for credential harvesting or malware distribution. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 4

  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/how-to-hack-minigame-testing-place-on-roblox-game-hack
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-roblox-goft-cards-generator-no-human-verification_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-robux-needs-password_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-robux-no-offers-2021_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-to-get-accessories-in-roblox-for-free_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-do-u-get-free-robux_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-corruption-hack_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-robux-without-verification-2021_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/minecraft-dungeons-free_GM479516143.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-to-download-minecraft-for-free-ios_GM479516143.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/les-commandes-dadmin-roblox-les-plus-cheat_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-black-clover-online-cheat_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-robux-hack-generator-2021_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/how-to-get-free-robux-easy-no-download_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/coin-master-free-coins-link_GM406889139.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-hack-download-for-pc_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/ways-to-get-free-robux_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/minecraft-hacks-115-2_GM479516143.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/free-ship-code-roblox_GM431946152.pdf
    • http://elearning.mtsnlingga.sch.id/__statics/gudangsoal/files/roblox-com-free-robux_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003021.bin
39b514601a8f2f1b8e6d480ed1cfaa9b7f29c14d7cb405bbe17c9012027b8795		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3021 22184 bytes
font_01_sfnt_off00006154.bin
eb8fef5064c05a6e4c791b205eebd64e2ec55a76fb74bdd6c8b17aeaef0b7c1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6154 19656 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.