PDF malware analysis — malicious · 02f26bc61a20002c

MALICIOUS

PDF

33.3 KB Created: 2021-07-05 05:38:13 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: da78bc0e6e8b8d131098ce3dd367931b SHA-1: 6d606c10afae897afe154ec46407ce4a2bf7f00e SHA-256: 02f26bc61a20002cf19d7660ba5a8a5bf714f66f617e8f62e31d81e73d042862

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document contains numerous embedded URLs and a clear call-to-action related to obtaining free in-game currency, such as 'Free Robux'. This pattern is consistent with phishing or scam lures designed to trick users into downloading malware or visiting malicious sites. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/431946152/free-robux-pastebin-game-hack
- http://lib.akper17.ac.id/repository/coin-master-apk-hack-mod-download_GM406889139.pdf
- http://lib.akper17.ac.id/repository/daily-coin-master-free-spins_GM406889139.pdf
- http://lib.akper17.ac.id/repository/bluebird-free-roblox-youtube_GM431946152.pdf
- http://lib.akper17.ac.id/repository/coin-master-free-cards-2021_GM406889139.pdf
- http://lib.akper17.ac.id/repository/coin-master-100-spin-hack_GM406889139.pdf
- http://lib.akper17.ac.id/repository/roblox-free-rubox_GM431946152.pdf
- http://lib.akper17.ac.id/repository/coin-master-free-spins_GM406889139.pdf
- http://lib.akper17.ac.id/repository/how-to-get-free-coins-on-flip-master_GM406889139.pdf
- http://lib.akper17.ac.id/repository/coin-master-hack-for-android_GM406889139.pdf
- http://lib.akper17.ac.id/repository/free-robux-on-phone_GM431946152.pdf
- http://lib.akper17.ac.id/repository/coin-master-heaven-free-spins_GM406889139.pdf
- http://lib.akper17.ac.id/repository/free-minecraft-com_GM479516143.pdf
- http://lib.akper17.ac.id/repository/free-roblox-accounts-with-robux-that-work-not-banned-2021_GM431946152.pdf
- http://lib.akper17.ac.id/repository/how-to-get-minecraft-for-free-on-iphone_GM479516143.pdf
- http://lib.akper17.ac.id/repository/easy-ways-to-get-free-robux_GM431946152.pdf
- http://lib.akper17.ac.id/repository/best-free-roblox-clothes_GM431946152.pdf
- http://lib.akper17.ac.id/repository/free-robux-easy-and-fast_GM431946152.pdf
- http://lib.akper17.ac.id/repository/bux-free-robux_GM431946152.pdf
- http://lib.akper17.ac.id/repository/free-robux-live_GM431946152.pdf
- http://lib.akper17.ac.id/repository/get-free-robux-today_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002daa.bin` `7b6ed98318c49f4bc7bc1791d4921ba0fbbf599d84fa2bfa8ac2ab27e4c05578`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2DAA	21704 bytes
`font_01_sfnt_off00005d15.bin` `5bfd890d84b0c14d72a786ae590b650f833002b15fe449ee91ced07c3ea68d33`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D15	19092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.