PDF malware analysis — malicious · 2456dbadf6a01e72

MALICIOUS

PDF

46.4 KB Created: 2021-05-15 05:03:50 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 6b874b3ecc7c076e739bdc2399caf3b9 SHA-1: cf223d77684f498f2998f35949714f0998499cb6 SHA-256: 2456dbadf6a01e7290b7d05f6c2ec24b50f1b5bc608f2c1736e769ef12dd9d4d

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document body and extracted URLs indicate a lure related to hacking game accounts and obtaining in-game currency. The critical heuristic firing for 'SE_SECRET_RECOVERY_LURE' suggests the document attempts to trick users into revealing sensitive information like passwords or private keys. While no scripts were extracted, the presence of external URLs and the nature of the lure strongly suggest a phishing or credential harvesting attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.8696

Heuristics 4

Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE

Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/how-to-hack-roblox-accounts-passwords-game-hack
- http://elearning.mysadam.info/__statics/gudangsoal/files/20210-robux_GM431946152.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/need-free-spins-for-coin-master_GM406889139.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/how-to-get-free-admin-in-roblox_GM431946152.pdf
- http://www.elearning.mysadam.info/__statics/gudangsoal/files/robux-hacks-2021_GM431946152.pdf
- http://www.elearning.mysadam.info/__statics/gudangsoal/files/hack-coin-master-free_GM406889139.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/coin-master-2021-free-spins-link-blogspot_GM406889139.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/coin-master-daily-free-spins-link_GM406889139.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/free-robux-hack-no-verification_GM431946152.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/free-coin-master-spins-2021_GM406889139.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/robux-free-2021_GM431946152.pdf
- http://www.elearning.mysadam.info/__statics/gudangsoal/files/coin-master-fan-page-facebook_GM406889139.pdf
- http://www.elearning.mysadam.info/__statics/gudangsoal/files/how-to-hack-coin-master-in-pc_GM406889139.pdf
- http://www.elearning.mysadam.info/__statics/gudangsoal/files/minecraft-free-edition_GM479516143.pdf
- http://www.elearning.mysadam.info/__statics/gudangsoal/files/free-coins-for-coin-master_GM406889139.pdf
- http://www.elearning.mysadam.info/__statics/gudangsoal/files/free-spin-coin-master-hacktoman_GM406889139.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/roblox-robux-hack_GM431946152.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/coin-master-free-spins-hack_GM406889139.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/coinmaster-spin-ml-link_GM406889139.pdf
- http://elearning.mysadam.info/__statics/gudangsoal/files/free-robux-without-doing-anything_GM431946152.pdf
- http://www.elearning.mysadam.info/__statics/gudangsoal/files/easy-roblox-today_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004e31.bin` `457f72ffdb29800b90fbb1e74aa45a2ee3fda2ce2f19a88a4d38068c88e89037`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4E31	24628 bytes
`font_01_sfnt_off000086b1.bin` `10d025f04f706eb71cdda4f99784df1b9ccb52e48080e43095e0398eaef6f132`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x86B1	2880 bytes
`font_02_sfnt_off0000909c.bin` `1a35cdd5966ddf5a07fa4c0cf1a4b7623ebf18d314e768fc1998c6779142cc7b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x909C	18916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.