Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2de42059f75068b…

MALICIOUS

PDF

38.5 KB Created: 2021-05-21 19:00:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)
MD5: 3a61223aca1a38e88086fd0d7e188913 SHA-1: aba0d42e69be15e1b4a0bd3a61938d819e178a4a SHA-256: e2de42059f75068bdedcfd86b58fac7c1914c4b1565de09a99e0069005c58bf4
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains lures for free Robux and includes multiple URLs that likely host malicious payloads. The presence of a 'download button' heuristic and the 'password-protected archive' lure suggest an attempt to trick the user into downloading and potentially decrypting malware. While no scripts were directly extracted, the embedded URLs and the nature of the lure indicate a phishing attempt to deliver a second-stage payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9476

Heuristics 4

  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-robux-that-actually-works-game-hack
    • http://gieldapracy.pl/images/roblox-rape-hack_GM431946152.pdf
    • http://gieldapracy.pl/images/roblox-free-hair-girl_GM431946152.pdf
    • http://gieldapracy.pl/images/ways-to-get-free-robux_GM431946152.pdf
    • http://gieldapracy.pl/images/daily-free-spins-coin-master-2021_GM406889139.pdf
    • http://gieldapracy.pl/images/how-to-get-free-roebucks-in-roblox_GM431946152.pdf
    • http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off0000317b.bin
259f16fe2f059279a7fb7b1fd3105849bc7a650a9340b495f1898ea58f2b738e		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x317B 29140 bytes
font_01_sfnt_off000072da.bin
e9e8736bed1826902485352f20294e96b644ee357cd6186db79dc9b33c578c67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72DA 19136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.