PDF malware analysis — malicious · 1b45b77bfb59e8a2

MALICIOUS

PDF

56.0 KB Created: 2021-05-13 02:38:05 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 78cf7d65f84be44bfbaeb4c75c120592 SHA-1: e4523d2f929793abb6374b9ce1adb2f93e6e2be4 SHA-256: 1b45b77bfb59e8a2096a52f0ee4e0e00699d91427b31f28e671c3e61ed6c80ab

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document contains multiple embedded URLs and a primary external URI pointing to sites offering game-related cheats and downloads, consistent with a phishing or malware distribution lure. The ML classifier also flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the overall context suggest an attempt to redirect users to malicious content, likely for credential harvesting or malware delivery.

Machine Learning

Nyx PDF Classifier malicious score 0.8162

Heuristics 4

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-free-spins-today-daily-links-game-hack
- https://www.ktcart.co.in/uploaded_files/userfiles/files/rbxcity-free-robux_GM431946152.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/coin-master-tiradas-gratis-2021_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/free-spin-coin-master-hacktoman_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/coin-master-daily-free-spin-app_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/free-roblox-codes_GM431946152.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/coin-master-free-spins-link-app-download_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/how-to-hack-coin-master-game_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/coin-master-free-rewards-link_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/teach-me-to-hack_GM431946152.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/how-to-hack-any-roblox-account_GM431946152.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/coin-master-hack-ios-no-verification_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/rblx-gg-free-robux_GM431946152.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/moonactive-coin-master-free-spins_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/twitter-coin-master-free-spins_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/how-to-get-free-admin-in-roblox_GM431946152.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/chisel-and-bits-mod-pe_GM479516143.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/coin-master-gift-link_GM406889139.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/how-to-hack-someones-roblox-account-2021_GM431946152.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/minecraft-reach-hack_GM479516143.pdf
- https://www.ktcart.co.in/uploaded_files/userfiles/files/coin-master-stop-attack-hack_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004cd5.bin` `8909e55e6ac296532bfb064ca73153aab132bf36dcec52a6d3e9de660a6dca93`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4CD5	26576 bytes
`font_01_sfnt_off00008ab4.bin` `1bd985f7cab931e546a7114ee80c1df3885b38349add8be3963c1931efeb4240`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8AB4	3152 bytes
`font_02_sfnt_off000095c2.bin` `cf7ae5cf6bef3222f5a26bec705b492fed0278aec6b16ec101aeda46e0edd2b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x95C2	7960 bytes
`font_03_sfnt_off0000a8e8.bin` `52d597ff4b9023df6b3510b92f87dc1d2329aed0448bc9fa59130058567cb992`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA8E8	18652 bytes
`font_04_sfnt_off0000cc10.bin` `fac9a06ceb5574feb8580c075df3ef69dfbd0efa4947186cfe90f11b68eaafb0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCC10	4272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.