PDF malware analysis — malicious · 467f4340c61e2df0

MALICIOUS

PDF

35.0 KB Created: 2021-06-30 22:02:19 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16

MD5: 6908518230215898ac16d896d15747c4 SHA-1: 62e2cc90d3ddb3e4819aa2ab41519504158efa9f SHA-256: 467f4340c61e2df0f5595ce7132f379b495ab21853de3ea2efe1f958c4eb6986

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded URLs and a document body that promotes free items and hacks for popular games, indicating a lure for users to download potentially malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or scam attempt. The presence of external URIs and the overall deceptive content suggest a malicious link attack vector.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/free-animations-roblox-catalog-game-hack PDF link annotation
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/all-players-in-roblox-passwords-password-hack_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/roblox-c9m_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/free-robux-that-actually-works-2021_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/2021-roblox-hack-client_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/coin-master-heaven-free-spins-and-coins_GM406889139.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/roblox-free-play_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/free-robux-websites-that-actually-work_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/free-robux-no-human-verification-or-survey_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/roblox-robux-hack-generator_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/robux-hackhttps-pastebincom-mc23cpnm_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/files-blue-roblox-hack-download_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/spin-free-coin-master_GM406889139.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/roblox-sign-in-free_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/how-to-hack-roblox-accounts_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/how-to-hack-roblox-on-phone-jailbreak_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/coin-master-unlimited-spins-hack_GM406889139.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/free-robux-hack_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/cool-free-stuff-on-roblox_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/hack-roblox-2021_GM431946152.pdfIn PDF document text
- http://www.espaciocultivarte.com/ckfinder/userfiles/files/how-do-you-get-free-robux-without-paying_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000316e.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x316E	22416 bytes
SHA-256: `565dfc6be6f29c43f3ecb830b0e3b5422c9ba52151d8cf91d4266ce2d44e1e58`
`font_01_sfnt_off00006374.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6374	19132 bytes
SHA-256: `91cec64d4169026b09a4ecd70625d436bfd77256226c59354ee494550a8cb485`

Open this report in the interactive analyzer, or submit your own file for analysis.