PDF malware analysis — malicious · c7ea48fae9bcfbe1

MALICIOUS

PDF

35.8 KB Created: 2021-07-06 20:37:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29

MD5: d827e5fed7dc07f959603e07627ef467 SHA-1: 86a9584089274d17b2654f4faf202020cca1cec2 SHA-256: c7ea48fae9bcfbe108e6afbd11590e9fdcc7e0c2ff4b91893df3552483f86515

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document employs a lure related to game hacks, specifically for Roblox, to entice users to click on a malicious URL. The primary URL identified, http://netcdn.tw/app/431946152/roblox-adopt-me-hack-game-hack, is flagged as a high-risk indicator. The document's content and heuristics strongly suggest it is designed to redirect users to potentially harmful sites for further exploitation or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/431946152/roblox-adopt-me-hack-game-hack PDF link annotation
- http://www.woundcare4heroes.org.uk/uploads/files/files/free-robux-reeddeem-code_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/roblox-no-download-hack_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/mad-city-roblox-hack-saison-4_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/free-minecraft-skins-girl_GM479516143.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/free-robux-discord_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/codes-how-to-get-free-robux_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/roblox-health-cheat_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/how-to-hack-roblox-account-2021_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/free-promo-codes-roblox-october-2021_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/coin-master-hack-xyz_GM406889139.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/how-to-hack-someones-account-on-roblox-2021_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/how-to-upgrade-to-roblox-builders-club-free_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/robux-free-hack-with-no-human-verification_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/roblox-free-vip-server-pet-simulator_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/free-robux-gen-website_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/free-robux-no-human-verification-or-survey-2021_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/free-400-spins-coin-master_GM406889139.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/how-to-get-free-robux-without-surveys_GM431946152.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/coin-master-extra-spins_GM406889139.pdfIn PDF document text
- http://www.woundcare4heroes.org.uk/uploads/files/files/hack-apps-for-roblox-video-pc_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000032a6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x32A6	22820 bytes
SHA-256: `24ae33a37111d22a293525711765760b92649f9b989cd697cfc7be93212733f0`
`font_01_sfnt_off00006629.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6629	19308 bytes
SHA-256: `1d6d529828a603e65e14b6285156acac3d11e3a25e7a00ad8dd7aee01cb73554`

Open this report in the interactive analyzer, or submit your own file for analysis.