PDF malware analysis — malicious · 2e834a5e9e697da3

MALICIOUS

PDF

44.1 KB Created: 2021-06-11 06:45:44 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: fd9bf89fed0bbe5daf277639e7fe28b7 SHA-1: f184c4841afccf0b41b1f493f1fad92e5a9ecc9f SHA-256: 2e834a5e9e697da3e76bd6c0c1d527538e9a3e48a980f6b09eaa5fae5009fc3d

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains numerous embedded URLs and a lure suggesting users copy/paste content to execute commands, indicating a phishing or malware distribution attempt. The ML classifier strongly flagged this PDF as malicious. The document body and embedded URLs promote free in-game items, a common lure for credential harvesting or malware downloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9865

Heuristics 4

Clipboard command execution lure high SE_CLIPBOARD_COMMAND_LURE

Document tells the user to copy or paste clipboard content into Run, PowerShell, cmd, or another shell-like execution context
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.tw/app/431946152/getbucks-free-com-roblox-game-hack
- https://www.belgium-archery.be/images/free-stuff-on-roblox-hack_GM431946152.pdf
- https://www.belgium-archery.be/images/free-roblox-gift-card-codes-2021-august_GM431946152.pdf
- https://www.belgium-archery.be/images/minecraft-client-download_GM479516143.pdf
- https://www.belgium-archery.be/images/coin-master-70-spin-link-2021_GM406889139.pdf
- https://www.belgium-archery.be/images/coin-master-free-spins-link-2021-haktuts_GM406889139.pdf
- https://www.belgium-archery.be/images/how-to-hack-roblox-to-get-free-robux_GM431946152.pdf
- https://www.belgium-archery.be/images/robux-download_GM431946152.pdf
- https://www.belgium-archery.be/images/coin-master-free-spins-daily-2021_GM406889139.pdf
- https://www.belgium-archery.be/images/master-coin-free-link_GM406889139.pdf
- https://www.belgium-archery.be/images/play-free-games-online-without-downloading-roblox_GM431946152.pdf
- https://www.belgium-archery.be/images/how-to-get-free-headphones-on-roblox-2021_GM431946152.pdf
- https://www.belgium-archery.be/images/earn-free-robux_GM431946152.pdf
- https://www.belgium-archery.be/images/free-spins-coin-master_GM406889139.pdf
- https://www.belgium-archery.be/images/free-robux-website-bloxburg-sign_GM431946152.pdf
- https://www.belgium-archery.be/images/how-to-get-free-robux-promo-codes_GM431946152.pdf
- https://www.belgium-archery.be/images/how-to-hack-people-in-roblox_GM431946152.pdf
- https://www.belgium-archery.be/images/minecraft-apk-114_GM479516143.pdf
- https://www.belgium-archery.be/images/free-spins-for-coin-master-app_GM406889139.pdf
- https://www.belgium-archery.be/images/how-to-hack-roblox-admin_GM431946152.pdf
- https://www.belgium-archery.be/images/minecraft-hacked-client-18_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000050aa.bin` `e2e8d6e22ff2e0f4eee00b9c9763f8bd60850e4f8872c7ab14d4d3aba9ea40e7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x50AA	24724 bytes
`font_01_sfnt_off000088e6.bin` `75ae5be6945e795fe6c9a6a4a04fa1a59785b5bce4625d50e9b88671945f7cb2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x88E6	18620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.