PDF malware analysis — malicious · 0a9b59c4095d2b4f

MALICIOUS

PDF

46.7 KB Created: 2021-05-10 17:33:08 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: ac45f3b5a26de1b69f26ac30da93d827 SHA-1: ea8285ed370875b5886eac4c17f54bae638d087a SHA-256: 0a9b59c4095d2b4f88399d07f42bf064966ae6450a668f8823e654ac734ec4ae

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF document was flagged by an ML classifier as malicious. It contains numerous embedded URLs and a document body that promotes free in-game currency and account hacks for popular games like Coin Master and Roblox. The presence of a "download button" heuristic and the overall theme suggest a lure to download further malicious content, likely disguised as game cheats or tools.

Machine Learning

Nyx PDF Classifier malicious score 0.8948

Heuristics 4

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-free-spins-and-coins-2021-game-hack
- https://www.transvision.id/ckfinder/userfiles/files/coin-master-apk_GM406889139.pdf
- https://www.transvision.id/ckfinder/userfiles/files/free-roebucks_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/how-to-get-free-snacks-on-coin-master_GM406889139.pdf
- https://www.transvision.id/ckfinder/userfiles/files/how-to-get-free-coins-on-coin-master_GM406889139.pdf
- https://www.transvision.id/ckfinder/userfiles/files/how-to-hack-roblox-accounts-on-phone_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/get-free-spins-on-coin-master_GM406889139.pdf
- https://www.transvision.id/ckfinder/userfiles/files/free-roblox-girl-hair-not-a-model_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/roblox-com-robux_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/minecraft-112-2-hacked-client_GM479516143.pdf
- https://www.transvision.id/ckfinder/userfiles/files/free-roblox-followers-generator-2021_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/free-spins-promo-code-for-coin-master_GM406889139.pdf
- https://www.transvision.id/ckfinder/userfiles/files/roblox-free-robux-hack_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/coin-master-free-link-spin_GM406889139.pdf
- https://www.transvision.id/ckfinder/userfiles/files/free-robux-with-no-survey_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/free-robux-mobile_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/hacks-to-get-free-robux_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/free-robux-no-human-verification-or-survey-or-download-2021_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/free-robux-just-click_GM431946152.pdf
- https://www.transvision.id/ckfinder/userfiles/files/bit-ly-coin-master-hack_GM406889139.pdf
- https://www.transvision.id/ckfinder/userfiles/files/get-free-spins-coin-master-link_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004cb9.bin` `4d1db47135f247cd3efbc668831e95accd190fb8ca56cd37ed05dd1dcdae1c8c`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4CB9	25556 bytes
`font_01_sfnt_off0000882c.bin` `27f6ee24b80a0c45a340e32027a43d6c3a7853aac96563eed14d58819399f6a8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x882C	3460 bytes
`font_02_sfnt_off00009397.bin` `c259e1f543e24e5bfe6ce8cf601a342cc00786119f62dbfadbed712250492c46`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9397	18460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.