PDF malware analysis — malicious · 4aaa4c9a31789fb1

MALICIOUS

PDF

48.2 KB Created: 2021-05-15 02:39:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 993a97eb8603bc682eeb706167e7357e SHA-1: f1d0da59261284b26242c43d031b22dd6b8b0f60 SHA-256: 4aaa4c9a31789fb1e4dba13b161a5798a56f1a51671aca4b4152c6e54fce76be

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs that are part of a link farm, likely designed to drive traffic to scam or phishing sites. The document body, though partially corrupted, contains references to 'free Robux' and a URL associated with game hacks, reinforcing the lure. The ML classifier and PDF link farm heuristics strongly indicate malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9977

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/how-do-u-get-free-robux-game-hack
- https://alarmed.pl/images/plug-toolbox-for-minecraft-free-ios_GM479516143.pdf
- https://alarmed.pl/images/coin-master-online-free-spin_GM406889139.pdf
- https://alarmed.pl/images/daily-free-spins-coin-master_GM406889139.pdf
- https://alarmed.pl/images/free-coin-and-spin-in-coin-master_GM406889139.pdf
- https://alarmed.pl/images/free-spin-coin-master-2021_GM406889139.pdf
- https://alarmed.pl/images/coin-master-free-coins_GM406889139.pdf
- https://alarmed.pl/images/free-spins-coin-master-links-blogspot_GM406889139.pdf
- https://alarmed.pl/images/www-roblox-com-robux-free_GM431946152.pdf
- https://alarmed.pl/images/coin-master-apk_GM406889139.pdf
- https://alarmed.pl/images/village-coin_GM406889139.pdf
- https://alarmed.pl/images/how-to-get-free-coins-in-coin-master_GM406889139.pdf
- https://alarmed.pl/images/cute-free-hair-on-roblox_GM431946152.pdf
- https://alarmed.pl/images/how-to-get-free-robux-for-free_GM431946152.pdf
- https://alarmed.pl/images/minecraft-free-apk-java-edition_GM479516143.pdf
- https://alarmed.pl/images/hacking-apps-for-roblox_GM431946152.pdf
- https://alarmed.pl/images/google-coin-master-free-spins_GM406889139.pdf
- https://alarmed.pl/images/links-to-get-free-spins-on-coin-master_GM406889139.pdf
- https://alarmed.pl/images/free-spins-for-coin-master-that-work_GM406889139.pdf
- https://alarmed.pl/images/free-minecraft-resource-packs_GM479516143.pdf
- https://alarmed.pl/images/free-roblox-accounts-with-robux-that-work-2021_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004ae9.bin` `c466ea6cf8fb34a1b1c4eacd98c0b52ca34ee16a8e9238f758c47ef8498e1b0e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4AE9	35828 bytes
`font_01_sfnt_off0000998a.bin` `ab6f51fdb1eed883fd21dff3bd0336e3a1b816e6c21a8924207bfe84ed9a007e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x998A	18636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.