Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9ae05cba7fd4f74…

MALICIOUS

PDF

51.6 KB Created: 2021-06-08 14:27:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: edca6c2fdebe1a6defc0125956c94dc5 SHA-1: 0f7589ac140b5bc896ea7b7b28f3a257b90c7280 SHA-256: d9ae05cba7fd4f74a1555f966ef9cb659fe9f5a07c8c967776a3f282b518edc1
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document employs a brand-impersonation lure, specifically mentioning Facebook and offering free game-related content like Roblox hacks. The primary malicious indicator is the embedded URL, https://netcdn.tw/app/431946152/youtube-free-roblox-game-hack, which is designed to redirect users to potentially harmful content. The ML classifier also strongly flagged this PDF as malicious, supporting the observed phishing and redirection tactics.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9464

Heuristics 4

  • Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH
    Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://netcdn.tw/app/431946152/youtube-free-roblox-game-hack.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/youtube-free-roblox-game-hack PDF link annotation
    • http://svadba-moda.kg/images/roblox-how-to-get-free-pp-in-plaza_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/free-robux-kid-friendly-no-human-verification_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/free-robux-without-human-verification-2021_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/free-robux-exe_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/free-robux-without-doing-anything_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/minecraft-free-ios_GM479516143.pdfIn PDF document text
    • http://svadba-moda.kg/images/free-robux-easy-and-fast_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/robux-hack-2021_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/roblox-hack-generator_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/roblox-robux-hack_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/how-do-you-get-free-robux-without-verification_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/coin-master-free-spins-link-today-new-2021_GM406889139.pdfIn PDF document text
    • http://svadba-moda.kg/images/get-free-robux-roblox-2021_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/minecraft-font-free_GM479516143.pdfIn PDF document text
    • http://svadba-moda.kg/images/how-to-hack-roblox_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/how-to-hack-survoivr-in-roblox-pc_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/free-robux-redeem-codes_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • http://svadba-moda.kg/images/free-minecraft-account-reddit_GM479516143.pdfIn PDF document text
    • http://svadba-moda.kg/images/noob-vs-pro-vs-hacker-roblox-bloxburg_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00004e9f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4E9F 25652 bytes
SHA-256: 9bc3cd6605f34176c045b70d12117bce94a240418415d895c0e18eb48b482b13
font_01_sfnt_off00008a88.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A88 8704 bytes
SHA-256: ddfd86c88a6b8304bc31eeb9f28c8110fac325cdacc87503bacf4ac741777490
font_02_sfnt_off0000a6f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA6F2 18356 bytes
SHA-256: ffbad32173b32cc4594fd33841e8c9e5ec126a10145e5a6c045a3d4a0eec64d4

Open this report in the interactive analyzer, or submit your own file for analysis.