PDF malware analysis — malicious · bd4f788e2c2b8ccd

MALICIOUS

PDF

43.5 KB Created: 2021-06-07 15:02:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-13

MD5: cf605320c90daeec9b656af2534d4e3f SHA-1: 1a10593cbd715b31e55b9153e8ffe1b3c7b8ca8c SHA-256: bd4f788e2c2b8ccd5707d451ad2be8b98b50a095a9b443d0dae326aab33e2a9e

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to websites offering 'free Robux' or 'free followers'. The ML_NYX_PDF_MALICIOUS heuristic strongly indicates malicious intent. The document body, though heavily obfuscated, contains references to 'how to buy Robux for free' and a URL that aligns with this theme, suggesting a lure for users seeking in-game advantages, likely leading to phishing or scam pages.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/how-to-buy-robux-for-free-2021-game-hack PDF link annotation
- http://grupodin.com.br/images/get-free-followers-on-tiktok_GM835599320.pdfIn PDF document text
- http://grupodin.com.br/images/minecraft-hacks-for-2b2t_GM479516143.pdfIn PDF document text
- http://grupodin.com.br/images/how-to-get-unlimited-robux_GM431946152.pdfIn PDF document text
- http://grupodin.com.br/images/coin-master-gift-hack_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/free-robux-2021_GM431946152.pdfIn PDF document text
- http://grupodin.com.br/images/cute-free-hair-on-roblox_GM431946152.pdfIn PDF document text
- http://grupodin.com.br/images/what-is-coin-master-app_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/links-for-free-spins-for-coin-master_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/free-spins-and-coins-blogspot-coin-master_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/roblox-skins-boy-free_GM431946152.pdfIn PDF document text
- http://grupodin.com.br/images/coin-master-hack-apk-facebook-login_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/free-robux-no-verify_GM431946152.pdfIn PDF document text
- http://grupodin.com.br/images/roblox-free-play_GM431946152.pdfIn PDF document text
- http://grupodin.com.br/images/hack-para-coin-master-singapore_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/minecraft-bedrock-free-with-java_GM479516143.pdfIn PDF document text
- http://grupodin.com.br/images/how-to-get-2021-robux-for-free_GM431946152.pdfIn PDF document text
- http://grupodin.com.br/images/coin-master-apk-free-download_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/10-free-spins-coin-master_GM406889139.pdfIn PDF document text
- http://grupodin.com.br/images/free-tiktok-followers-without-human-verification-2021_GM835599320.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000503b.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x503B	27412 bytes
SHA-256: `064b545585a03752a2683aa21ee7cd8b921ec241ced3e59e46d1d5e5c6431d29`
`font_01_sfnt_off00008cfe.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8CFE	18760 bytes
SHA-256: `632d723f22b0036b46c9174c949a49c01edcfe69b4b633ad7358dec715807d73`

Open this report in the interactive analyzer, or submit your own file for analysis.