PDF malware analysis — malicious · 4815eaf91cbb5234

MALICIOUS

PDF

46.6 KB Created: 2021-06-11 03:26:54 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: c42f26dcfdbce731a99b06d87814ca41 SHA-1: f186b83680ce7b43b8a1b9e7fa115d4458847c66 SHA-256: 4815eaf91cbb52345d7e451cf9db7152d3ef1c0e1f297dccc2d33ea92e2709b9

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure for a "Roblox Tix Lord Hack" and embeds multiple URLs pointing to potentially malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs and a visual download button lure further support a malicious intent. The document's content and embedded links suggest it is designed to trick users into downloading malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9832

Heuristics 4

Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/roblox-tix-lord-hack-game-hack
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/prison-life-script-roblox-hack-pastebin_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/this-game-has-shut-down-roblox-cheat-engine_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/arbx-club-free-robux-2021_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/haktuts-coin-master-free-daily-spins_GM406889139.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/how-to-hack-roblox-for-robux-2021_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/how-to-kick-in-free-draw-2-roblox_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/free-minecraft-maps_GM479516143.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/bc-free-roblox-android_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/does-cheat-engine-work-for-roblox-2021_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/free-minecraft-alt-generator_GM479516143.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/how-to-get-free-tiktok-likes_GM835599320.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/tap-for-free-robux_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/rixty-free-robux_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/hacks-gratis-roblox_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/how-to-hack-roblox-accounts-in-game-with-rc7_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/free-roblox-clothing-designs_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/roblox-island-royale-money-hack_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/trigon-roblox-hack_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/robux-maniac-robux-hack_GM431946152.pdf
- https://www.cryptovision.com/wp-content/uploads/fsqm-files/unpatchable-free-robux-made-by-robuxian_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005282.bin` `fbba8b463a9ea4ce50caada083f28735824725ed330fa63c026609e0d127ba04`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5282	28372 bytes
`font_01_sfnt_off000092f0.bin` `51a5ca454c4e5c4d06f8f141ba0b13a0fa9059b1cfe7958eec5e33ca2c124b02`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x92F0	18476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.