PDF malware analysis — malicious · 251b5888517814be

MALICIOUS

PDF

46.2 KB Created: 2021-05-17 13:24:11 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 002011fd282307a423ee6be59b33a4fa SHA-1: 91b3ea9b753f5e1d758f488100f4a90a800132cd SHA-256: 251b5888517814bed30e10459afd0888430c59bb60f169966833e533e048d227

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains a critical heuristic firing for requesting recovery secrets, combined with multiple embedded URLs pointing to game-related hacks and cheats. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves luring the user to click on a link to download a secondary payload, likely a cheat or hack tool.

Machine Learning

Nyx PDF Classifier malicious score 0.9432

Heuristics 4

Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE

Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/http-blackgames.us-coin-master-hack-game-hack
- http://pesok-rk.ru/images/how-to-get-free-robux-without-email_GM431946152.pdf
- http://pesok-rk.ru/images/free-robux-websites-2021_GM431946152.pdf
- http://pesok-rk.ru/images/coin-master-free-spins-link-2021_GM406889139.pdf
- http://pesok-rk.ru/images/free-spin-coin-master-today_GM406889139.pdf
- http://pesok-rk.ru/images/rbxoffer-com-free-robux_GM431946152.pdf
- http://pesok-rk.ru/images/robux-fun-hack_GM431946152.pdf
- http://pesok-rk.ru/images/free-robux-that-actually-works_GM431946152.pdf
- http://pesok-rk.ru/images/coin-master-hack-ios-2021_GM406889139.pdf
- http://pesok-rk.ru/images/roblox-play-as-guest-free_GM431946152.pdf
- http://pesok-rk.ru/images/www-bandicam-com-free-robux_GM431946152.pdf
- http://pesok-rk.ru/images/coin-master-free-coins-and-spins-link_GM406889139.pdf
- http://pesok-rk.ru/images/roblox-com-hack_GM431946152.pdf
- http://pesok-rk.ru/images/roblox-generator_GM431946152.pdf
- http://pesok-rk.ru/images/free-robux-2021-no-verification_GM431946152.pdf
- http://pesok-rk.ru/images/how-to-get-free-robux-without-doing-anything_GM431946152.pdf
- http://pesok-rk.ru/images/coin-master-heaven-free-spins_GM406889139.pdf
- http://pesok-rk.ru/images/minecraft-pocket-edition-free_GM479516143.pdf
- http://pesok-rk.ru/images/coin-master-pc-game-free-download_GM406889139.pdf
- http://pesok-rk.ru/images/hack-version-of-coin-master-apk-download_GM406889139.pdf
- http://pesok-rk.ru/images/free-robux-videos_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004859.bin` `344f369c1b0af79b50a0540b34e0a97e41014cb60d6d7937710765ff9934db6b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4859	26428 bytes
`font_01_sfnt_off00008577.bin` `7aee9e503a5ce204a8a322bb3f7914cecf17d3f4dda4772d0d3ff378ba95a3d6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8577	2932 bytes
`font_02_sfnt_off00008f9f.bin` `e1ce9e50dc4c3ad4d5b024a56bf1f44a8cbdcd2d74a5ef61a387106358d48fcb`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8F9F	19136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.