PDF malware analysis — malicious · b48715bf62810fc1

MALICIOUS

PDF

49.5 KB Created: 2021-06-11 12:19:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 26e2ff9572860b4bd948792dca3c5402 SHA-1: 13abdb8da1ef84a608312b69190474f21c566061 SHA-256: b48715bf62810fc152528233f83cf954019b0daf24a2225b0095bfd762d2ec19

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous embedded URLs and a link farm, all related to obtaining free Robux, indicating a scam or phishing attempt. The presence of a PDF_URI heuristic firing and the ML_NYX_PDF_MALICIOUS score strongly suggest malicious intent. While no scripts were explicitly extracted, the structure and embedded links point towards a malicious document designed to redirect users to potentially harmful sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9796

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/www-get-free-robux-com-game-hack
- https://www.carela-group.com/wp-content/uploads/fsqm-files/how-do-u-get-free-robux-2021_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/site-cheat-roblox_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/quiero-ser-hacker-en-roblox_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/cheats-for-roblox-deathrun_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/robux-hack-sin-verificacion-humana_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/hack-roblox-apk-mod_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/roblox-field-of-battle-hack_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/how-to-get-free-robux-august-2021_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/royal-high-school-roblox-how-to-gwet-free-mony_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/cbr-free-roblox_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/indian-gamer-roblox-ninja-legends-hacks_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/free-robux-100-real-no-fake_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/coin-master-free-spins-and-coins-blogspot_GM406889139.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/who-did-i-get-free-robux_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/jjsploit-v2-roblox-hack_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/como-tener-dinero-infinito-en-jailbreak-roblox-hack_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/minecraft-pe-015-0-apk-free-download_GM479516143.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/free-roblox-accounts-obc-lifetime_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/how-to-get-free-robux-without-verification-or-surveys_GM431946152.pdf
- https://www.carela-group.com/wp-content/uploads/fsqm-files/exploit-script-executor-free-download-roblox_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005460.bin` `033abec8b9223258e37edb0b646f55c04ec029300ce8f230c20b9668a705f1c7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5460	28352 bytes
`font_01_sfnt_off000093a2.bin` `972979c3a46100cf5f8fd289bc6fbd2496ff75fec0e3f6753648c72ec6eba714`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x93A2	2820 bytes
`font_02_sfnt_off00009d42.bin` `7452279f8d33b19d989b679b6499410e6e2cc25977e26f731e7a95c14bbaf67f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9D42	18740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.