Malicious PDF — malware analysis report

Static analysis result for SHA-256 d42a7a6655110cf6…

MALICIOUS

PDF

34.1 KB Created: 2021-06-21 12:43:40 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-02
MD5: cf225c83b083b3d89fbcaee33acaca6c SHA-1: 0e40e9f1d76ae56d7a5e797c46fa1b966a2b7f81 SHA-256: d42a7a6655110cf6de650b0f413022787061603fe7d0902b6dc92d19420b95ae
142 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document employs a common lure related to obtaining free virtual currency ('Robux') for the game Roblox, or other game hacks. It contains multiple embedded URLs pointing to external sites, including one that appears to be a CAPTCHA-themed lure. The ML classifier strongly flagged this PDF as malicious, and the heuristics indicate it's designed to redirect users to potentially harmful content, likely as part of a phishing or scam campaign. No scripts were extracted, but the document's structure and embedded links suggest an attempt to trick users into visiting malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9980

Heuristics 6

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Invisible PDF links to CAPTCHA-themed web lure high PDF_CAPTCHA_LINK_LURE
    PDF contains invisible clickable link annotations that point to a CAPTCHA/capcha-themed web path. This is a common phishing and ClickFix-style routing pattern: the PDF itself is inert, while the linked page performs the credential prompt or fake verification.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://netcdn.co/app/431946152/free-robux-no-scam-or-hack-game-hack PDF link annotation
    • https://loba.com.vn/public/upload/files/how-to-cheat-at-roblox_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/free-robux-com_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/cheats-for-blodody-mary-roblox_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/free-robux-hack-generator_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/hacks-to-get-free-robux_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/spin-rewards-coin-master_GM406889139.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/como-conseguir-robux-gratis-en-roblox-2021-hack_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/can-you-hack-roblox-accounts_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/install-free-game-coin-master_GM406889139.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/coin-master-free-cards-link-2021_GM406889139.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/coin-master-free-in-app-purchases-jailbreak_GM406889139.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/coin-master-hack-pro-gamers_GM406889139.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/tiktok-follower-bot-free_GM835599320.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/coin-master-tiradas-gratis-2021_GM406889139.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/free-robux-hack-2021_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/coin-master-free-coins-link-2021_GM406889139.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/best-free-minecraft-skins_GM479516143.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/free-robux-captcha_GM431946152.pdfIn PDF document text
    • https://loba.com.vn/public/upload/files/how-you-get-free-robux_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003026.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3026 21748 bytes
SHA-256: 297570670fbe2458934e28bfa69f07f88836962a30973cfcba8785101ca80427
font_01_sfnt_off00006016.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6016 19148 bytes
SHA-256: 53783bf833e1487b1577ba7087ce9e93ada1d3c4b5a89f240b9a9b52598f10a6

Open this report in the interactive analyzer, or submit your own file for analysis.