PDF malware analysis — malicious · e69c164732a93246

MALICIOUS

PDF

34.7 KB Created: 2021-06-17 17:10:49 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2026-06-04

MD5: c246b4f0e61f4bc5d70124b3eb7c1f51 SHA-1: d1dae10fde9c26153679b935e8730626bfa27027 SHA-256: e69c164732a93246cda150190eded4fb7f7d1142918804d4fa0d7a17e73e748e

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a malicious redirector link that leads to a DLL file, identified by the heuristic PDF_MALICIOUS_REDIRECTOR_LINK. The presence of a visual download button and the document body content related to game hacks suggest a social engineering lure to trick users into downloading malware. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/hacks-.dll-para-roblox-bee-swarm-simulator-game-hack In PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/roblox-games-with-free-boombox_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/minecraft-java-edition-free-download_GM479516143.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/how-to-get-minecraft-for-free-on-iphone_GM479516143.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/how-to-get-free-spins-in-coin-master_GM406889139.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/chat-hack-roblox-pastebin_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/free-roblox-accounts-2021_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/free-robux-inventory_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/free-robux-hack-no-human-verification-or-survey_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/how-to-get-free-robux-easy-2021_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/free-spins-coin-master-links_GM406889139.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/oprewards-com-robux_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/coin-master-free-spins-2021_GM406889139.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/minecraft-hacked-client_GM479516143.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/free-robux-website_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/free-coin-master-spins-blog_GM406889139.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/minecraft-anarchy-server-no-hacks_GM479516143.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/free-100-robux_GM431946152.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/simplysarc_GM479516143.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/coin-master-hacks-that-actually-work_GM406889139.pdfIn PDF document text
- https://www.alamrayabali.com/assets/CKImages/files/robux-com-free_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000305b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x305B	22016 bytes
SHA-256: `d3454ed9aeadaae93d01b81f45ad8ba71019ecf02a62347c6184b2a90090af5f`
`font_01_sfnt_off000060df.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x60DF	19652 bytes
SHA-256: `209acf37f52b7f75028397215651a9d20ddd405693b752740b3977b8e57b9a48`

Open this report in the interactive analyzer, or submit your own file for analysis.