PDF malware analysis — malicious · 4710462bc213c78f

MALICIOUS

PDF

33.9 KB Created: 2021-06-30 04:21:10 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: d2048f57fac0b6c6b1f88500418b5cb9 SHA-1: f7101676790a18de51e665fd36521b2fa437d852 SHA-256: 4710462bc213c78f042d7d2b9d909a3c3eefdaecd15f0ac888bf8d3aa05004a9

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document was flagged by an ML classifier as malicious. It contains embedded URLs and a document body that explicitly mentions game hacks and cheats for Roblox, suggesting a lure for users seeking such content. The presence of a 'password-protected archive' heuristic indicates a common tactic to conceal malicious payloads, likely downloaded via the embedded URLs. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/roblox-dex-hack-game-hack
- https://library.stikeswnpalu.ac.id/repository/roblox-cheat-engine-no-viruses_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/free-robux-no-password-needed-and-no-offers_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/robux-plus-hack_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/survivor-hack-scrip-t-roblox_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/free-robux-no-verify-2021_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/hack-de-robux-2021-abril_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/free-roblox-cards-pin-number_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/free-star-wars-clothes-on-roblox-games_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/robux-game-com_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/tiktok-free-like-bot_GM835599320.pdf
- https://library.stikeswnpalu.ac.id/repository/how-to-use-cheat-engine-on-roblox-without-shutdown-2021_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/easy-robux-com_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/60-free-spins-coin-master_GM406889139.pdf
- https://library.stikeswnpalu.ac.id/repository/earn-robux-com_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/xbox-hack-to-play-roblox_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/coin-master-hack-2021_GM406889139.pdf
- https://library.stikeswnpalu.ac.id/repository/pinkant-free-robux_GM431946152.pdf
- https://library.stikeswnpalu.ac.id/repository/coin-master-100-spin-slot_GM406889139.pdf
- https://library.stikeswnpalu.ac.id/repository/coin-master-free-cards_GM406889139.pdf
- https://library.stikeswnpalu.ac.id/repository/roblox-adopt-me-hacks-2021_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002de2.bin` `b085d2892cbbe5c20969acaf21995d3effaec32bcf5d8b46d91542e077a01d6b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2DE2	22460 bytes
`font_01_sfnt_off0000601d.bin` `30c3b920ba68a4d0ed0fd0c5404d89321e5ca9b97be7288ac522156b6769914f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x601D	18824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.