PDF malware analysis — malicious · def91c84eed081bc

MALICIOUS

PDF

45.3 KB Created: 2021-06-01 13:47:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-16

MD5: 3b15f6d7fbb70370de59ac54ea968477 SHA-1: 1c43091af78bba6d646b96c61aa79f716e69c319 SHA-256: def91c84eed081bcff0002808fd20bbed1a442c078776e4b3d7e826a28e119ae

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF file contains embedded URLs and heuristics indicating a brand-impersonation credential phishing lure, specifically impersonating Facebook to offer a Roblox hack. The primary URL, https://netcdn.xyz/app/431946152/i'm-gonna-hack-roblox-game-hack, is likely used to deliver a malicious payload or harvest credentials. No scripts were extracted from this sample, but the presence of external URIs and the ML classifier's high confidence score support the malicious verdict.

Machine Learning

Nyx PDF Classifier malicious score 0.9864

Heuristics 4

Brand-impersonation credential phishing lure high SE_BRAND_CREDENTIAL_PHISH

Document impersonates a well-known consumer brand and uses account-security / verification language ('unusual activity', 'account on hold', 'verify your account') to steer the reader to a credential-harvesting link. Corroborated by: call-to-action link host does not match the impersonated brand: https://netcdn.xyz/app/431946152/i.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/i PDF link annotation
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/roblox-hacked-com-2021_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-crown-for-roblox_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-roblox-promo-code-genarator_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/bleu-roblox-hack-key_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/cheat-files-robux-generator_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/how-to-hack-someones-roblox-account_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/roblox-free-robux-may-2021_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/give-me-free-robux_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-tiktok-hearts_GM835599320.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/hack-cuentas-gratis-en-roblox-pastebin_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-mobile-360-free-robux_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/slurp-hack-roblox-jailbreak_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/robux-hack-me_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/how-to-get-free-robux-without-verifying-2021_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/play-minecraft-for-free_GM479516143.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-robux-no-human-verification-2021_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/free-robux-games-on-roblox_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/how-to-download-minecraft-for-free-on-mac_GM479516143.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/roblox-free-medieval-hood_GM431946152.pdfIn PDF document text
- https://altaviastagerace.it/wp-content/uploads/fsqm-files/roblox-studio-free-robux_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005242.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5242	26064 bytes
SHA-256: `0a22ae20484c8b9b77a743c9eba1dc46d94de132d518aebeb4ef3d206dcdca3f`
`font_01_sfnt_off00008ddd.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DDD	18508 bytes
SHA-256: `6166709c30f34fc5effa556e5f5e5e86f81cfe2c02363ab713ae2a80b14d1dbe`

Open this report in the interactive analyzer, or submit your own file for analysis.