Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e48487b4b8252b9…

MALICIOUS

PDF

41.0 KB Created: 2021-04-27 15:37:04 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-15
MD5: b2bc1fd0cf6b76448f8e4c32d3563962 SHA-1: 5af58066e587bb647f069ffe8b9effb7398044b9 SHA-256: 1e48487b4b8252b9370a31a99900c352da27b85a1aa5e1bc12b0583a2d0943dc
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links pointing to known malicious redirector infrastructure, specifically designed to host a Roblox hacking script. The document body and heuristics indicate a lure to download potentially harmful content. The presence of multiple links to related 'hack' and 'cheat' PDFs further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9941

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/431946152/prisonbreaker-v1.5-hack-script-roblox-pastebin-game-hack In PDF document text
    • http://www.saburai.ac.id/elibrary//repository/egg-hacker-2021-roblox.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-play-a-game-that-cost-robux-free.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/roblox-hack-and-cheats-apk.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-hack-roblox-sites.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-get-free-robux-urban420-network.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/robux-hack-no-human-verification-android.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/auto-rap-battles-roblox-hack.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/how-to-get-a-private-server-in-roblox-for-free.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/free-stuff-on-roblox-mobile.pdfIn PDF document text
    • http://www.saburai.ac.id/elibrary//repository/free-robux-really-easy.pdfIn PDF document text
    • https://freerobux.cyouIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004139.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4139 25408 bytes
SHA-256: 9d26d0c4a50687c5b9646bef18c27250a13bfedc92586d1d39cf362e4bb63ca2
font_01_sfnt_off00007bb9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7BB9 19176 bytes
SHA-256: f6528d04ca828c1c6abb66050f7c28c06b4dadf88abecab2a46b10b22bf87d82

Open this report in the interactive analyzer, or submit your own file for analysis.