PDF malware analysis — malicious · 80d6d11944739542

MALICIOUS

PDF

16.0 KB Created: 2021-07-03 21:51:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 32c64c1460b775927d3f2448f1643de6 SHA-1: cad77c1550441f210bef55ce61c691e2cb747792 SHA-256: 80d6d119447395426acfab3c1cf13d76bdf547a39150a6b5ce60b162d3e93600

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are related to game exploits and free in-game currency for popular games like Roblox and Coin Master. The ML classifier strongly indicated maliciousness, and the presence of embedded URLs suggests a phishing or scam attempt designed to redirect users to potentially harmful sites. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9902

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/431946152/how-to-get-free-hair-in-roblox-game-hack
- https://www.midrarreservations.com/uploaded_files/userfiles/files/earn-free-robux-today_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/how-to-get-free-spins-on-coin-master-android_GM406889139.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/roblox-hacked-version-download_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/i-got-hacked-on-roblox_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/how-to-hack-a-roblox-account-kazok_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/free-roblox-gift-card-codes-2021-unused_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/roblox-strucid-hitbox-hack-2021-august_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/how-to-get-free-black-wings-in-roblox_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/2021-robux-hack-inspect-element_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/tiktok-free-zoom_GM835599320.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/how-to-hack-someones-account-on-roblox_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/free-robux-geneorater_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/how-to-hack-roblox-to-get-free-robux_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/roblox-robux-hack-generator-no-survey-2021_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/how-to-get-to-village-3-in-coin-master_GM406889139.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/free-minecraft-java-server_GM479516143.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/how-to-get-free-robux-in-roblox-no-survey_GM431946152.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/coin-master-free-download-pc_GM406889139.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/coin-master-heaven-links-free-spins_GM406889139.pdf
- https://www.midrarreservations.com/uploaded_files/userfiles/files/pokemon-go-joystick-free-download_GM1094591345.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.