PDF malware analysis — malicious · 785a0f2df5234366

MALICIOUS

PDF

48.0 KB Created: 2021-06-11 05:55:15 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: f3abba36cc25858806b9d7e739a806a0 SHA-1: 1ab8b04f18ed7a108d4a3063fd8db557148b8338 SHA-256: 785a0f2df523436643fd883d3e1031104bb971c81795a6344728e8537f4b2e8b

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs that link to external sites, many of which are structured as SEO-optimized PDF link farms. The document body and extracted URLs suggest a lure for free in-game items (Robux, Coin Master spins), which is a common tactic for phishing or malware distribution. The presence of external URI findings and a high ML confidence score further support its malicious nature.

Machine Learning

Nyx PDF Classifier malicious score 0.9796

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/autoboss-roblox-free-robux-pastebin-2021-game-hack
- https://cursocejas.com.br/imagens/userfiles/files/free-spins-link-in-coin-master-2021_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/roblox-login-hack_GM431946152.pdf
- https://cursocejas.com.br/imagens/userfiles/files/coin-master-free-spins_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/free-links-for-free-coins-and-spins-for-coin-master_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/how-to-get-800-robux-for-free_GM431946152.pdf
- https://cursocejas.com.br/imagens/userfiles/files/download-minecraft-java-edition-free_GM479516143.pdf
- https://cursocejas.com.br/imagens/userfiles/files/minecraft-clipart-free_GM479516143.pdf
- https://cursocejas.com.br/imagens/userfiles/files/free-spins-coin-master-app-iphone_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/free-promo-codes-for-coin-master_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/how-to-get-free-robux-without-verification-or-surveys_GM431946152.pdf
- https://cursocejas.com.br/imagens/userfiles/files/robux-free-c_GM431946152.pdf
- https://cursocejas.com.br/imagens/userfiles/files/how-to-get-20210-robux-for-free_GM431946152.pdf
- https://cursocejas.com.br/imagens/userfiles/files/links-for-free-spins-for-coin-master_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/free-roblox-executor-no-key_GM431946152.pdf
- https://cursocejas.com.br/imagens/userfiles/files/free-robux-generator-2021_GM431946152.pdf
- https://cursocejas.com.br/imagens/userfiles/files/40-free-spins-coin-master_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/coin-master-home_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/coin-master-daily-gift-free-spins-and-coins-link-today_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/free-spins-coin-master-links_GM406889139.pdf
- https://cursocejas.com.br/imagens/userfiles/files/minecraft-dungeons-free-download-pc_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000532e.bin` `5963870cd87ab5361eeb865dbb6f85dd5da5eb26ec64cc4c6086da980c22ab7e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x532E	24916 bytes
`font_01_sfnt_off00008ce5.bin` `77ae1c4cffa647a8fd533dfa4102e94364989f9e80b9cd131876e9d1005899a2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8CE5	2832 bytes
`font_02_sfnt_off00009695.bin` `f68b654a00c772a1491ba337139a7b59b46059f8619825996d19a65adef53b46`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9695	19096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.