PDF malware analysis — malicious · d904c246ab323aef

MALICIOUS

PDF

41.6 KB Created: 2021-05-17 05:30:40 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 7ae559f2cc8d60ab3eff1c80a44ac0cd SHA-1: e3ff70312c9929d26275f95eaa5a25e945627a3a SHA-256: d904c246ab323aefe5452116068b9227243dab777b4627133991d450ea5c56e5

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file contains a large number of embedded external links, identified as a link farm. The primary URL, https://netcdn.xyz/app/431946152/free-roblox-money-game-hack, and numerous others hosted on vodomery.kiev.ua, suggest a lure for free game currency or hacks. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious intent behind the link farm.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/free-roblox-money-game-hack
- https://vodomery.kiev.ua:443/images/bux-free-robux_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdf
- https://vodomery.kiev.ua:443/images/coin-master-free-spins-link-no-verification-2021_GM406889139.pdf
- https://vodomery.kiev.ua:443/images/free-robux-no-human-verification-and-no-survey_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/how-to-get-minecraft-pocket-edition-for-free_GM479516143.pdf
- https://vodomery.kiev.ua:443/images/orewards-com-free-robux_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/is-minecraft-education-edition-free_GM479516143.pdf
- https://vodomery.kiev.ua:443/images/robloxheroxyz-free-robux_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/how-to-hack-roblox-accounts-2021-easy_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/how-to-get-free-robux-in-2021_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/free-spin-in-coin-master_GM406889139.pdf
- https://vodomery.kiev.ua:443/images/best-free-roblox-executor_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/coin-master-hacks-free-spins_GM406889139.pdf
- https://vodomery.kiev.ua:443/images/how-to-get-free-robux-2021_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/ww-robux_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/hack-coin-pro-coin-master_GM406889139.pdf
- https://vodomery.kiev.ua:443/images/coin-master-hack-apk-july-2021_GM406889139.pdf
- https://vodomery.kiev.ua:443/images/10-robux_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/free-roblox-hair-codes_GM431946152.pdf
- https://vodomery.kiev.ua:443/images/free-coin-link-coin-master_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000046fd.bin` `5c78f3ea6015b4e6cb2981219dcd19e16a7be410514bc52cabbd1e61dfeca707`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x46FD	25184 bytes
`font_01_sfnt_off00007ff3.bin` `592c86f68d7cfce1f91e7ace661462f05e7807c87c96d21e42ea748452481f78`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7FF3	18324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.