PDF malware analysis — malicious · dfd2e44ecffbda6f

MALICIOUS

PDF

46.4 KB Created: 2021-06-02 04:05:20 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 28d330fc8d59aa410edecac4a5526369 SHA-1: 28e1b7c58e6183bb65cc835f380f2193a9a71d95 SHA-256: dfd2e44ecffbda6f6f931388d8f37292d043ad75ef69990a2c098e0d738f2e64

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

This PDF document is identified as malicious due to its structure and embedded URLs, which form a link farm designed to redirect users to potentially harmful content. The document body and extracted URLs suggest a lure related to "Roblox Hacks", aiming to trick users into downloading further malicious payloads. The presence of numerous external PDF links and a high ML classifier score indicate a deliberate attempt to distribute malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9832

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/roblox-hacks-no-injector-game-hack
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/all-roblox-2021-free-tails_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/www-free-robux_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/roblox-tycoon-pc-cheats_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/identifty-fraud-roblox-maxe-1-cheat_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/how-to-hack-roblox-to-get-robux_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/roblox-biggest-hacks-ever-top-10_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/roblox-ro-hero-academia-hack_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/new-roblox-infinite-jump-exploit-hack-working-2021_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/free-minecraft-skin-maker_GM479516143.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/roblox-dragon-ball-after-future-clicker-script-hack_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/modz-para-ser-hacker-modz-gratis-para-roblox_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/yt-how-download-script-hack-roblox-jailbreak-2021_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/how-to-get-speed-hack-in-roblox-booga-booga_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/300-robuxs-for-free_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/roblox-apocalypse-rising-god-mode-hack_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/how-to-get-free-robux-easy-2021_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/minecraft-noob-vs-pro-vs-hacker-vs-noob-roblox_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/free-catalog-roblox-items_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/free-robux-without-human-verification_GM431946152.pdf
- https://meerdanverzekeren.nl/wp-content/uploads/fsqm-files/free-tiktok-accounts-and-passwords_GM835599320.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off00005439.bin` `22accfeff637cca6eae9b4a49d2a378e5bec4f8363c62a8ae0499b78a7b30c46`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x5439	26472 bytes
`font_01_sfnt_off00009234.bin` `29b7ee6320cff0e34eccd165b0538655c157bd2bd6803889e7402770d18e9684`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9234	18476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.