PDF malware analysis — malicious · 20807966cf78c76c

MALICIOUS

PDF

44.1 KB Created: 2021-05-13 01:10:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-29

MD5: f1e6b9651eebee31502e513a0f017e27 SHA-1: 9b0b56e297c5846f79c4a4eb3fde4ff4f09953ad SHA-256: 20807966cf78c76c7e135dc0982bd152d31a78f648daa62400e8a6c3d9996be8

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple links and a lure related to game hacks and free currency for popular mobile games like Coin Master and Roblox. The primary link, https://netcdn.xyz/app/406889139/coin-master-heaven-free-spins-link-2021-game-hack, is flagged as a game hack redirector. The document's content and the presence of numerous similar links suggest a phishing or scam attempt to direct users to potentially malicious websites or downloads. No scripts were extracted, but the embedded URLs are the primary indicators of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9648

Heuristics 4

PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE

PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-heaven-free-spins-link-2021-game-hack PDF link annotation
- http://www.valenciamaids.com/userfiles/files/coin-master-hacks-no-surveys_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/free-robux-by-watching-ads_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/roblox-hack-tool_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/download-coin-master-apk-hack_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/robux-free-robux_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/how-to-make-your-own-minecraft-pe-server-for-free_GM479516143.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/free-robux-giveaway_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/coin-master-hack-without-verification_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/free-robux-thumbnail_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/free-robux-websites-that-actually-work_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/coinmaster-spin-ml-free_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/coin-master-spin-link-hack_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/roblox-verification_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/roblox-controversy_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/free-coin-master-coins-2021_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/free-attacks-coin-master_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/coin-master-free-attack-link_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/free-robux-obby-2021_GM431946152.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/how-to-get-free-spins-on-coin-master-2021_GM406889139.pdfIn PDF document text
- http://www.valenciamaids.com/userfiles/files/how-to-get-free-premium-roblox_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000048f9.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x48F9	24152 bytes
SHA-256: `0d7cd89dc89f1af03761a137b17d9ffaf1265c1061076beb7c2f6f6f90a294cd`
`font_01_sfnt_off00007ef0.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7EF0	2840 bytes
SHA-256: `3fb127b764b9d10f5525bc4de5ec8316de704409ccb0cf21cff3ad8a30d11676`
`font_02_sfnt_off000088a1.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x88A1	18572 bytes
SHA-256: `9953a6bcf7299cdc3f53a486839c0d2d9be693cd5b14fd285ca1faa973488d1b`

Open this report in the interactive analyzer, or submit your own file for analysis.