PDF malware analysis — malicious · 2c76726a36a88ad6

MALICIOUS

PDF

46.5 KB Created: 2021-06-13 21:59:59 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 15f67520893b27edf6930f1c79f3f4fd SHA-1: becd086c2655980d2adeb5fe044b4975aa7c9d83 SHA-256: 2c76726a36a88ad64180ea251105fae03a8af14757d2ffbefccd5fb71b5adcc4

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains lures for downloading content, specifically related to game hacks and cheats, and includes instructions to copy/paste into a command-line context. This suggests an attempt to trick the user into executing malicious commands or downloading further malware. The presence of multiple URLs pointing to similar content reinforces the phishing and potential malware distribution vector.

Machine Learning

Nyx PDF Classifier malicious score 0.8948

Heuristics 4

Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/how-to-get-hacks-on-midieval-roblox-2021-game-hack
- http://acp-institut.fr/images/free-private-minecraft-server_GM479516143.pdf
- http://acp-institut.fr/images/get-free-spins-on-coin-master-2021_GM406889139.pdf
- http://acp-institut.fr/images/no-cool-down-hack-roblox-sword-burst-online-mac_GM431946152.pdf
- http://acp-institut.fr/images/get-free-robux-generator_GM431946152.pdf
- http://acp-institut.fr/images/free-minecraft-capes_GM479516143.pdf
- http://acp-institut.fr/images/coin-master-links-2021_GM406889139.pdf
- http://acp-institut.fr/images/good-free-minecraft-server-hosting_GM479516143.pdf
- http://acp-institut.fr/images/minecraft-free-apk_GM479516143.pdf
- http://acp-institut.fr/images/free-roblox-hack_GM431946152.pdf
- http://acp-institut.fr/images/free-robux-redeem-codes_GM431946152.pdf
- http://acp-institut.fr/images/free-robux-gen_GM431946152.pdf
- http://acp-institut.fr/images/where-to-get-free-robux_GM431946152.pdf
- http://acp-institut.fr/images/how-to-hack-someones-roblox-account-with-cheat-engine_GM431946152.pdf
- http://acp-institut.fr/images/free-spins-and-coins-coin-master_GM406889139.pdf
- http://acp-institut.fr/images/free-minecraft-thumbnails_GM479516143.pdf
- http://acp-institut.fr/images/free-robux-codes-generator-no-verification_GM431946152.pdf
- http://acp-institut.fr/images/coin-master-free-soins_GM406889139.pdf
- http://acp-institut.fr/images/free-spins-coin-master-hack-2021_GM406889139.pdf
- http://acp-institut.fr/images/como-generar-coin-master-free-spins_GM406889139.pdf
- http://acp-institut.fr/images/cheat-engine-roblox-money-hack_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004a75.bin` `ed7c90f3b0060d95ce8fdd98aa527e11de246b7b54af13b9b71205b324068135`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4A75	25420 bytes
`font_01_sfnt_off00008432.bin` `4b3e0f36ad1e0c7e3ea5c178fd2b4f097d1e01575fc6a4101a8b520db34dfe07`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8432	3400 bytes
`font_02_sfnt_off00008f5b.bin` `011b54f7648ce89fc004a87d7935c019a490c11165edb8915177ffa28e69a50d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8F5B	19456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.