Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9222cbafbc2e7f8…

MALICIOUS

PDF

34.3 KB Created: 2021-06-26 03:32:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16
MD5: 67028c61108767f224dca7bf7e30509b SHA-1: b326f39f1c4fa4f7e0f2cb2bf6c38f7f38f64d59 SHA-256: f9222cbafbc2e7f81b09eb4ca274f93ce157b324eada327c25a17046a8a44229
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links to known malicious redirector infrastructure, specifically targeting users with lures related to popular games like Roblox and Minecraft. The document body and extracted URLs suggest a phishing attempt to trick users into downloading or accessing further malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/roblox-steve In PDF document text
    • http://jjpremiers.com/files/how-do-i-get-free-robux_GM431946152.pdfIn PDF document text
    • https://www.jjpremiers.com/files/10-000-robux-for-free_GM431946152.pdfIn PDF document text
    • http://jjpremiers.com/files/free-coins-and-spins-for-coin-master_GM406889139.pdfIn PDF document text
    • http://jjpremiers.com/files/free-robux-youtube_GM431946152.pdfIn PDF document text
    • http://jjpremiers.com/files/how-to-install-minecraft-for-free_GM479516143.pdfIn PDF document text
    • http://jjpremiers.com/files/robux-free-com_GM431946152.pdfIn PDF document text
    • https://www.jjpremiers.com/files/free-minecraft-generator_GM479516143.pdfIn PDF document text
    • https://www.jjpremiers.com/files/pokemon-go-free-to-play-guide_GM1094591345.pdfIn PDF document text
    • http://jjpremiers.com/files/how-to-keep-roblox-from-slowing-down-when-hacking_GM431946152.pdfIn PDF document text
    • http://jjpremiers.com/files/ways-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
    • http://jjpremiers.com/files/coin-master-hack-no-root_GM406889139.pdfIn PDF document text
    • http://jjpremiers.com/files/can-u-get-free-robux_GM431946152.pdfIn PDF document text
    • https://www.jjpremiers.com/files/free-spins-on-coin-masters_GM406889139.pdfIn PDF document text
    • https://www.jjpremiers.com/files/free-robux-only-1-step_GM431946152.pdfIn PDF document text
    • http://jjpremiers.com/files/haktuts-coin-master-free-spin-link-today_GM406889139.pdfIn PDF document text
    • http://jjpremiers.com/files/how-to-get-free-robux-instantly_GM431946152.pdfIn PDF document text
    • http://jjpremiers.com/files/get-free-lp-on-roblox_GM431946152.pdfIn PDF document text
    • http://jjpremiers.com/files/coin-master-heaven-free-spins-today_GM406889139.pdfIn PDF document text
    • http://jjpremiers.com/files/how-do-you-get-free-robux-on-roblox_GM431946152.pdfIn PDF document text
    • http://jjpremiers.com/files/free-spins-and-coins-coin-master-2021-link_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e38.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2E38 22580 bytes
SHA-256: bf394cf47371f83e62059007a4493b04378a85587e8e0a837e2ae2343ccbcfa4
font_01_sfnt_off00006043.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6043 19212 bytes
SHA-256: ca02bcdd92036ef313802c5875b02b09393b0689a257712faa1aa2c19e09363c

Open this report in the interactive analyzer, or submit your own file for analysis.