PDF malware analysis — malicious · 1e03676fc92f5796

MALICIOUS

PDF

38.4 KB Created: 2021-07-03 16:53:45 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: e25c586e199894ef482493c5ac7aefff SHA-1: 481e894458766d690d9f4746556bee799972fa57 SHA-256: 1e03676fc92f579639c28ea3b3c4aa74d6395334ee02dc1df1dc682d9236c30f

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains multiple embedded URLs and a call-to-action phrase, strongly suggesting a phishing or scam attempt. The ML classifier also flagged this PDF as malicious with high confidence. The document body and extracted URLs promote game hacks and freebies, indicating a lure to download potentially unwanted or malicious software.

Machine Learning

Nyx PDF Classifier malicious score 0.9985

Heuristics 4

Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL

PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/406889139/www-coin-master-hack-com-game-hack
- http://36.94.36.7/elib//repository/free-spin-link-coin-master-app_GM406889139.pdf
- http://36.94.36.7/elib//repository/do-you-get-windows-10-minecraft-for-free-with-java_GM479516143.pdf
- http://36.94.36.7/elib/repository/play-coin-master-online-free_GM406889139.pdf
- http://36.94.36.7/elib/repository/coin-master-freebies_GM406889139.pdf
- http://36.94.36.7/elib/repository/coin-master-hack-reddit_GM406889139.pdf
- http://36.94.36.7/elib/repository/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdf
- http://36.94.36.7/elib//repository/cheats-coin-master-free-spins-and-news_GM406889139.pdf
- http://36.94.36.7/elib/repository/how-to-download-minecraft-hacks_GM479516143.pdf
- http://36.94.36.7/elib/repository/how-to-get-free-robux-easy_GM431946152.pdf
- http://36.94.36.7/elib/repository/roblox-mod-free-shopping_GM431946152.pdf
- http://36.94.36.7/elib/repository/free-roblox-groups-with-funds_GM431946152.pdf
- http://36.94.36.7/elib/repository/get-coin-master-hack_GM406889139.pdf
- http://36.94.36.7/elib//repository/free-robux-live_GM431946152.pdf
- http://36.94.36.7/elib/repository/minecraft-xbox-360-free_GM479516143.pdf
- http://36.94.36.7/elib/repository/free-spins-and-coins-on-coin-master_GM406889139.pdf
- http://36.94.36.7/elib//repository/free-spin-link-for-coin-master_GM406889139.pdf
- http://36.94.36.7/elib/repository/play-roblox-games-for-free-no-download_GM431946152.pdf
- http://36.94.36.7/elib/repository/free-robux-with-inspect_GM431946152.pdf
- http://36.94.36.7/elib//repository/get-free-robux-2021_GM431946152.pdf
- http://36.94.36.7/elib//repository/minecraft-free-no-download_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off00003b87.bin` `94f65fec108d4011665d4c09d3c5481eeefb72c1e398b65fc3f5a552c8cbe0be`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3B87	24252 bytes
`font_01_sfnt_off000072da.bin` `60fc02595c4fd4bdb4ac2d5fd29e74a312ca99cfa8da20533531767e60f20837`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x72DA	18628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.