Malicious PDF — malware analysis report

Static analysis result for SHA-256 fdde259d7cf919f9…

MALICIOUS

PDF

37.7 KB Created: 2021-05-21 11:07:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-11-20
MD5: 86be3ce647087bd1390146ccc085933e SHA-1: 3bd8d44f7d45564e0c2916b64ac185ca8a237141 SHA-256: fdde259d7cf919f9994b54d27066ce04d1379f099e166871c23e17b0f6356685
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links and text that mimic a "free Robux" generator, a common lure for scams. The heuristic PDF_MALICIOUS_REDIRECTOR_LINK confirms that the primary link leads to known malicious infrastructure. While no scripts were explicitly extracted, the nature of the lure and the embedded links strongly suggest an attempt to redirect the user to a malicious site for credential harvesting or malware download.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9447

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/robux-match.com-free-robux-game-hack In PDF document text
    • https://www.sd-olimp.hr/files/coin-master-hack-2021-without-human-verification_GM406889139.pdfIn PDF document text
    • https://www.sd-olimp.hr/files/free-coin-master-spin-app_GM406889139.pdfIn PDF document text
    • https://www.sd-olimp.hr/files/free-minecraft-printables_GM479516143.pdfIn PDF document text
    • http://sd-olimp.hr/files/coin-master-card-hack-2021_GM406889139.pdfIn PDF document text
    • http://sd-olimp.hr/files/coin-master-online-hack-download_GM406889139.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_002_off00003252.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3252 27032 bytes
SHA-256: cce42e0cfc8ee9f63361bd40df39cbd05af1fb7a6d6b38ff5d0b725edd98f2a5
font_01_sfnt_off00007060.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7060 18904 bytes
SHA-256: 4a85ad6ffc73ad9b3f41fceca22de32e3ce7595015d69f53ae753139e52ac9f7

Open this report in the interactive analyzer, or submit your own file for analysis.