PDF malware analysis — malicious · ac4f92d1c1e3e1d0

MALICIOUS

PDF

46.1 KB Created: 2021-06-01 19:43:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 9cf5b2fa1c04e97332dcbc916b2a13e3 SHA-1: dbca6d8fd4a3d590b3b52bc53d947508b9b9e020 SHA-256: ac4f92d1c1e3e1d05aec0690e41ffe44624eb9b95d2a00a9443a30539a36cf9b

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains multiple embedded URLs and a heuristic firing for an MFA lure, suggesting it's designed to trick users into providing sensitive information or downloading further malicious content. The document body, though heavily corrupted, contains text related to game hacking and links to external sites, reinforcing the phishing or malware delivery intent. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9864

Heuristics 4

MFA / one-time-code harvesting lure high SE_MFA_LURE

Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/how-to-hack-for-more-cash-in-roblox-tycoon-games-game-hack
- https://registracomodo.it/wp-content/uploads/fsqm-files/free-roblox-synapse-x_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/rblx-gg-free-robux_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/minecraft-java-edition-code-free_GM479516143.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/cheat-roblox-abeille_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/best-free-minecraft-servers_GM479516143.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/roblox-infinite-jump-hack-2021_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/how-to-cheat-in-booga-booga-roblox_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/how-to-get-free-robux-hack-pastebin_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/websites-to-get-free-robux_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/roblox-shinobi-life-face-hack_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/i-hacked-my-haters-roblox-account_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/free-robux-without-verification_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/free-robux-scams_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/rblx-city-free-robux_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/objet-roblox-library-free_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/free-spins-for-coin-master_GM406889139.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/free-roblox-gift-card-codes-generator-no-survey_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/pastebin-hack-account-roblox_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/roblox-cheat-engine-crashes_GM431946152.pdf
- https://registracomodo.it/wp-content/uploads/fsqm-files/roblox-hack-tool_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000549b.bin` `3188c15d65614e66ad9b1f54430ab5921f92a67706f139fc9ef92a7662614263`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x549B	25460 bytes
`font_01_sfnt_off00008f13.bin` `8dc2ad9769f1fbdd5b6197425fda603e149906c7d26b76e06146ae24233b4c7d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8F13	19312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.