PDF malware analysis — malicious · bcbcef85cbf16ce8

MALICIOUS

PDF

34.0 KB Created: 2021-06-27 21:28:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: ef42815fb143ab1249813ce995a8425b SHA-1: f15e8681cb68896d2ceacd4e70fe20faeb10d503 SHA-256: bcbcef85cbf16ce8c4a3435a8b0fdbcb8b30588ab7e102fc093f700cb6afd773

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains numerous links to external websites, many of which are related to game hacks and free in-game currency, indicating a phishing or scam attempt. The heuristic 'PDF_SEO_LINK_FARM' and the presence of the URL 'http://netcdn.co/app/431946152/hack-of-robux-roblox-game-hack' strongly suggest the document is designed to redirect users to malicious content. No scripts were extracted from this sample, but the overall structure and content point to a social engineering attack.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/hack-of-robux-roblox-game-hack
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/free-tuxedo-roblox_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/how-to-get-builders-club-for-free-roblox_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/how-do-i-hack-roblox-free-robux_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/roblox-aimbot-dll-hack_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/how-to-actually-fly-hack-n-roblox-fe2_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/free-robux-no-verification-no-download_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/https-webrobloxcom-catalog-202163-hair-free_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/coin-master-free-spins-link_GM406889139.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/roblox-hack-with-winrar_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/roblox-how-to-hack-any-account_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/free-animation-roblox-june_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/hacks-for-roblox-trackid_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/how-to-gte-free-robux-2021_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/wwwroblox-hacksites_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/free-game-roblox-download_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/roblox-phantom-forces-hack_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/how-to-play-minecraft-for-free-on-pc_GM479516143.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/roblox-download-pc-windows-7-free_GM431946152.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/coin-master-free-spin-codes_GM406889139.pdf
- https://www.intercraftgallery.com/uploaded_files/userfiles/files/free-roblox-promo-codes-2021-may_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003019.bin` `0576889ec0466db49c24de314fd5650e9c5f46d74ce11422e42101ed7c2333f2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3019	21988 bytes
`font_01_sfnt_off0000607c.bin` `f478f1a6e327493c433a8945fc0eb55fa0a8846158f85cacda06ef6b6a09384c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x607C	18796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.