PDF malware analysis — malicious · cbc475a9afae9bf5

MALICIOUS

PDF

47.8 KB Created: 2021-06-02 12:44:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: ec502f4b08068d37fe5f8fe36a455d5f SHA-1: d2e78e5703abf0e95bac60d16fa8b61ae7e49630 SHA-256: cbc475a9afae9bf58e47eec8af143c017fdd33e29fa99fb33a77219b1c01fe53

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple URLs pointing to sites offering 'free Robux' and related game hacks, indicating a lure for potentially malicious downloads or phishing. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded URLs supports a phishing or malware distribution attack pattern. No scripts were extracted, but the overall context suggests a malicious document intended to trick users into visiting untrusted sites.

Machine Learning

Nyx PDF Classifier malicious score 0.9826

Heuristics 4

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/free-robux-quick-generator-game-hack
- https://vissalutis.pl/wp-content/uploads/fsqm-files/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/free-hoodie-roblox-shirt-template_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/free-tiktok-likes-without-verification_GM835599320.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/roblox-code-free_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/whost-get-gamepass-free-roblox-2021_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/hack-roblox-jailbreak-mode-tp-btools-no-clip_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/how-to-earn-robux-free-2021_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/how-to-hack-on-prison-life-roblox_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/tiktok-likes-for-free_GM835599320.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/free-k-upreme-freestyle-roblox-id_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/freer-pro-tiktok-fans_GM835599320.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/minecraft-free-online-games_GM479516143.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/how-to-get-red-glowing-eyes-in-roblox-for-free_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/free-robux-wallpaper_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/free-robux-no-download-or-survey-2021_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/free-tiktok-bots_GM835599320.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/free-robux-hack-2021_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/how-to-get-free-robux-2021-website_GM431946152.pdf
- https://vissalutis.pl/wp-content/uploads/fsqm-files/coin-master-daily-free-spins_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005318.bin` `5ac23155abf35bfe60d7ad090b71ae5751d2f04b0572aea619a4cb56a02be38e`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5318	25308 bytes
`font_01_sfnt_off00008cb3.bin` `972979c3a46100cf5f8fd289bc6fbd2496ff75fec0e3f6753648c72ec6eba714`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8CB3	2820 bytes
`font_02_sfnt_off00009653.bin` `51606d39dd23b7e07c873af919e0c47cad2b02ff6e4ac9a79ad3dda2127764dd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9653	18796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.