PDF malware analysis — malicious · 7bcf4d6a86a5300a

MALICIOUS

PDF

35.3 KB Created: 2021-06-30 10:04:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16

MD5: ea63de5f7f52a2d8e5be2872a4c131cd SHA-1: b7eb26301d3202cdc220b86dcbfa1192d9c9c048 SHA-256: 7bcf4d6a86a5300a3448ca6214da8d4d7fe48f74d88e95d79138d4b7814969ed

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains numerous links to external websites, many of which are SEO-optimized PDFs related to game cheats and free in-game currency, suggesting a lure for users to download potentially malicious content. The ML classifier also flagged this PDF as malicious with high confidence. The presence of a download button heuristic further supports the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/can-you-use-cheat-engine-in-2021-roblox-game-hack PDF link annotation
- https://www.similar.com.tw/upload/files/roblox-free-robux-no-human-verification_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/doctor-louie-roblox_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/how-to-get-free-robux-2021_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/coin-master-daily-free-spins-link-blogspot_GM406889139.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/roblox-lumber-tycoon-2-cheat-codes_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/wurst-minecraft_GM479516143.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/coin-master-free-card-link-today_GM406889139.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/roblox-free-robux-codes_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/how-to-get-free-robux-on-roblox-in-youtubecom_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/how-to-hack-gamepasses-on-roblox-ccv3_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/coin-master-free-spins-and-coins-link-today_GM406889139.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/how-to-get-free-robux-without-surveys_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/free-tiktok-like_GM835599320.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/minecraft-java-edition-free-trial_GM479516143.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/overhaul-roblox-free-shop_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/latest-roblox-hacks-2021_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/someone-has-hacked-into-my-roblox-account_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/free-roblox-accounts-with-robux-that-work-not-banned-2021_GM431946152.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/how-to-get-free-coins-and-free-spins-coin-master_GM406889139.pdfIn PDF document text
- https://www.similar.com.tw/upload/files/coin-master-hack-pro-gamers_GM406889139.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000030d6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x30D6	22568 bytes
SHA-256: `818a9c7afc59f47c4b4129d4ce138715af58f1ed1de551d3c793ba6f6df948af`
`font_01_sfnt_off00006329.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6329	19580 bytes
SHA-256: `149031aaff213c921df78ea5fe2172777f760b2125004100a15886c7fdca86cb`

Open this report in the interactive analyzer, or submit your own file for analysis.