PDF malware analysis — malicious · 930f8c5534bb70ae

MALICIOUS

PDF

50.7 KB Created: 2021-06-09 14:20:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 19a92ff35d69f0425a2459321a25139c SHA-1: 69d51afeac11dcdf0e8f32a52941a9d7e2d886fe SHA-256: 930f8c5534bb70aef0a6140cd828aca2d03d548274faaa36b879673d39781ec5

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains embedded URLs and a lure suggesting it provides a "Roblox Exploit Free" tool. The ML classifier strongly flagged this PDF as malicious, and the presence of external URIs indicates a likely attempt to download a second-stage payload. The document body, though heavily obfuscated, contains references to exploits and game hacks, reinforcing the malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9681

Heuristics 4

Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/c---roblox-exploit-free-game-hack
- https://www.bodyammo.in/uploaded_files/userfiles/files/free-robux-no-generator_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/easy-robux-today-com_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/roblox-vehicle-simulator-hack-download_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/coin-master-hack-no-human-verification_GM406889139.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/coins-master_GM406889139.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/get-free-spins-coin-master-link_GM406889139.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/how-to-get-free-robux-without-verification-2021_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/free-minecraft-server_GM479516143.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/free-roblox-passwords_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/coin-master-free-spins-link-2021-no-verification_GM406889139.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/try-coin-master-hack_GM406889139.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/roblox-robux-hack_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/free-coin-master-coins-2021_GM406889139.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/how-to-get-free-tiktok-fans-without-human-verification_GM835599320.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/coin-master-fan-club_GM406889139.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/free-robux-group-payouts_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/coin-master-hack-version-33-2_GM406889139.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/free-robux-2021_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/free-to-use-roblox-ads_GM431946152.pdf
- https://www.bodyammo.in/uploaded_files/userfiles/files/free-robux-kid-friendly-no-human-verification_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 4

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005174.bin` `2e10c5baea9d6cb2857411139082edd9e959da53439b17553e6a670e05c67f59`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5174	24288 bytes
`font_01_sfnt_off0000891e.bin` `10d025f04f706eb71cdda4f99784df1b9ccb52e48080e43095e0398eaef6f132`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x891E	2880 bytes
`font_02_sfnt_off00009304.bin` `62075f0fe13502d46afb6e55e83d440c29ef4988399537df1f86e7653ce3b744`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9304	6636 bytes
`font_03_sfnt_off0000a311.bin` `f30e3facae2c643767e3c70565ebfe1ce40c8d84fa6455645e7a1e7254930e4f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA311	18348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.