Malicious PDF — malware analysis report

Static analysis result for SHA-256 01005c2da18fb3bf…

MALICIOUS

PDF

40.6 KB Created: 2021-04-25 00:53:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-04
MD5: bd7d159a945cd49bd18b55e838196d39 SHA-1: 004909625c18d71daf948917dbf68eee736bbe30 SHA-256: 01005c2da18fb3bf4dabe27695afb4563543e3dd19e7ff7f2483afc22ef1d860
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains embedded links that point to known malicious redirector infrastructure, specifically targeting users with lures related to free game currency or hacks. The document body explicitly mentions 'Free Xbox Game' and 'Roblox Generator' and includes a call-to-action to 'CLICK HERE TO ACCESS ROBLOX GENERATOR', reinforcing the phishing pretext. The presence of multiple embedded URLs and the ML classifier's high confidence score indicate a malicious intent to direct users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/free-xbox-game.achievements-roblox-game-hack In PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/free-robux-website-not-a-scam-or-fake.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/free-roblox-tshirts.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/1-billion-free-robux.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/hack-system-roblox.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/2021-roblox-place-free-bricks-image.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/how-to-get-free-admin-on-any-roblox-game-2021.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/hacking-station-roblox.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/hackear-roblox-android.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/come-hack-my-account-youtube-roblox.pdfIn PDF document text
    • https://elearning.mtsalhuda.sch.id/__statics/gudangsoal/files/generate-robux-for-free-with-no-downloading-games.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00003f6d.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3F6D 26072 bytes
SHA-256: 94226768c6c96c2c3c7f62bdf4606cf5910f8b84464086ee9247729637da4dbb
font_01_sfnt_off00007b06.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7B06 19008 bytes
SHA-256: fa65493d0425b5e45f86254a41ebe43012be5688af0b7de32cab30347aad1da2

Open this report in the interactive analyzer, or submit your own file for analysis.