Malicious PDF — malware analysis report

Static analysis result for SHA-256 34a5804e1c8a2b61…

MALICIOUS

PDF

46.7 KB Created: 2021-06-07 10:21:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-04
MD5: 71aa2133d7912a634ea3847f7307591c SHA-1: 9329b11c949f71a435f2060ffe394394f6d8a030 SHA-256: 34a5804e1c8a2b6169a7041505b5cfb69ddd7e3c606d4867db2cb83d043a78a9
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains embedded links that point to known malicious redirector infrastructure, specifically leading to a URL related to 'free robloxian hack'. The ML classifier also flagged this PDF as malicious. The presence of these links suggests the document's primary purpose is to redirect users to potentially harmful websites, likely for malware distribution or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9832

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.tw/app/431946152/roblox-how-to-get-free-robloxian-2.0-game-hack In PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/dayz-og-roblox-cheat-codes_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/how-to-get-free-clothes-on-roblox-2021-no-bc_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/cars-watch-videos-free-robux_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/minecraft-free-download-ios_GM479516143.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/free-promo-codes-for-robux_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/how-to-hack-people-on-roblox-easy-2021_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/minecraft-hacks-115-2_GM479516143.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/robux-giver-download-free_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/roblox-bubble-gum-simulator-cheat-version_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/roblox-pokemon-brick-bronze-hack-download_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/minecraft-games-free-download_GM479516143.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/roblox-com-how-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/roblox-hack-download_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/minecraft-java-free-trial_GM479516143.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/roblox-robux-hack-exe_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/roblox-emperor-hack_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/free-robux-co_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/minecraft-education-edition-free_GM479516143.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/free-roblox-followers-2021_GM431946152.pdfIn PDF document text
    • https://srmap.edu.in/wp-content/uploads/fsqm-files/promo-code-roblox-robux-hack-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off000051d0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x51D0 27680 bytes
SHA-256: dd6c3a3f44ceeebf2cd8d95bb61d5284f9eb3001746474cd4c3cb39ab24bc235
font_01_sfnt_off000091f8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x91F8 18928 bytes
SHA-256: d9838478b51750e5d4ad085026fdcf6e5ca94e3b775bdeb26a13a8f472427111

Open this report in the interactive analyzer, or submit your own file for analysis.