PDF malware analysis — malicious · 30d76e8c05aa63ac

MALICIOUS

PDF

35.9 KB Created: 2021-07-04 03:51:06 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 23d27c9e7be2d52d89eb5b7bb32b5b6c SHA-1: 68e752793e7f4e895726930f97bf5056ea4874c4 SHA-256: 30d76e8c05aa63ac42afa230005fc8dfb9fb933c3cd132370fd1c2b42a60527c

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a launch action that directs the user to an external URL, which is highly suspicious. The document body and extracted URLs suggest a lure for free in-game items or followers, a common social engineering tactic. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Launch action high PDF_LAUNCH

PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/835599320/tiktok-followers-free-no-verification-game-hack
- https://www.wessexandrology.com/uploads/files/files/best-free-minecraft-server-hosting-reddit_GM479516143.pdf
- https://www.wessexandrology.com/uploads/files/files/play-coin-master-online-free_GM406889139.pdf
- https://www.wessexandrology.com/uploads/files/files/how-do-u-hack-roblox_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/free-spin-coin-master-game_GM406889139.pdf
- https://www.wessexandrology.com/uploads/files/files/roblox-speed-hack_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/rbx-place-free-robux_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/free-robux-no-human-verafy-no-servay-free_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/coin-master-hack-apk-online_GM406889139.pdf
- https://www.wessexandrology.com/uploads/files/files/veste-free-game-roblox_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/buy-tiktok-followers-free_GM835599320.pdf
- https://www.wessexandrology.com/uploads/files/files/how-to-get-a-lot-of-robux_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/coin-master-free-box_GM406889139.pdf
- https://www.wessexandrology.com/uploads/files/files/tool-roblox-hack_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/roblox-mod-apk-free-shopping_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/coin-master-free-spins-ios-app_GM406889139.pdf
- https://www.wessexandrology.com/uploads/files/files/coin-master-free-daily-spins-link-2021_GM406889139.pdf
- https://www.wessexandrology.com/uploads/files/files/free-coin-master-coins_GM406889139.pdf
- https://www.wessexandrology.com/uploads/files/files/minecraft-launcher-free_GM479516143.pdf
- https://www.wessexandrology.com/uploads/files/files/free-robux-html-pastebin_GM431946152.pdf
- https://www.wessexandrology.com/uploads/files/files/launch-hack-roblox_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000036d5.bin` `f4e5917daee404ff7765a02adc57dafcd9b52c21ff5f4048014b92aa5bc8f6d3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x36D5	22592 bytes
`font_01_sfnt_off0000697a.bin` `24a2a0ca419b5ee57c62fbc4bec787d902ed33a5149bf32ae928e2c187177985`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x697A	18344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.