PDF malware analysis — malicious · 99350b1c659477ec

MALICIOUS

PDF

47.5 KB Created: 2021-06-11 02:29:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: ad5ad083e846d6309cd448e65e9f8cfd SHA-1: f77ff3a8838f6a3b42ea8158769ab69e5108358a SHA-256: 99350b1c659477ecde58acedf3d23365a0eead77653a8087f06fd3c929c71152

142 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous external links, with a high-confidence heuristic flagging it as a link farm. The document body, though partially corrupted, includes a URL related to 'roblox card game hack', suggesting a lure. The presence of a 'payment redirection' lure heuristic further indicates a potential business-email-compromise or phishing attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9769

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE

Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/a-free-roblox-card-game-hack
- https://www.ferraroni.net/public/risorse/ck/files/how-to-hack-people-on-roblox_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/is-windows-10-minecraft-free_GM479516143.pdf
- https://www.ferraroni.net/public/risorse/ck/files/roblox-inappropriate_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/coin-master-hack-without-root_GM406889139.pdf
- https://www.ferraroni.net/public/risorse/ck/files/free-spins-coin-master-2021-hack_GM406889139.pdf
- https://www.ferraroni.net/public/risorse/ck/files/free-coins-and-spins-for-coin-master_GM406889139.pdf
- https://www.ferraroni.net/public/risorse/ck/files/jailbreak-roblox-hack_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/peple-hacking-to-get-robux_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/coin-master-spin-link-today_GM406889139.pdf
- https://www.ferraroni.net/public/risorse/ck/files/roblox-com-free-robux_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/free-coin-master-spin-generator_GM406889139.pdf
- https://www.ferraroni.net/public/risorse/ck/files/robux-download_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/free-tiktok-followers-without-downloading-apps_GM835599320.pdf
- https://www.ferraroni.net/public/risorse/ck/files/free-robux-no-scam_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/free-robux-glitch-2021_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/coin-master-2021-free-spins-link_GM406889139.pdf
- https://www.ferraroni.net/public/risorse/ck/files/app-store-coin-master-free-spins_GM406889139.pdf
- https://www.ferraroni.net/public/risorse/ck/files/apps-that-give-you-free-robux_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/easy-way-to-get-free-robux_GM431946152.pdf
- https://www.ferraroni.net/public/risorse/ck/files/free-robux-no-human-verification-and-no-survey_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off000051bc.bin` `fa73a2063a52a19b525dd59ac6cd61c4c1f38ccd0be1752595b834da2f8cd1c8`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x51BC	25212 bytes
`font_01_sfnt_off00008bb8.bin` `471f662098e83c5562504503f5e7603b336ca0957605358090bb98e15c7aed80`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8BB8	3112 bytes
`font_02_sfnt_off00009671.bin` `2a79cb0e99a0a78eba6cd6cf8e03001c4cd76c2a2b9ca49b91dc339e0ba1845c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9671	18348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.