PDF malware analysis — malicious · 373826590313d3d0

MALICIOUS

PDF

44.2 KB Created: 2021-05-15 23:07:17 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 8e8b7420f0237bf1612256e78707686c SHA-1: c8971339710d62da6ff3a69641d46836d4cfbf66 SHA-256: 373826590313d3d0f148c15dfe881cd51301a9610c43fa01755d742a8eae6dd1

142 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document exhibits high-risk lures related to secret recovery and payment redirection, suggesting a scam or phishing attempt. It contains multiple embedded URLs pointing to game hack download sites, and the ML classifier strongly indicates maliciousness. The presence of a visual download button further supports the lure to trick users into clicking malicious links.

Machine Learning

Nyx PDF Classifier malicious score 0.9648

Heuristics 5

Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE

Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE

Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/free-coin-master-coins-game-hack PDF link annotation
- https://heimatverein-oberlangen.de/images/coin-master-hack-game-download-mod-apk_GM406889139.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/coin-master-facebook-free-spins_GM406889139.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/free-robux-promo-codes_GM431946152.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/free-robux-redeem-codes-2021_GM431946152.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/wurst-client-112-2_GM479516143.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/robux-generator-no-survey_GM431946152.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/free-spin-in-coin-master_GM406889139.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/how-do-you-hack-minecraft_GM479516143.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/minecraft-hacked-client-18_GM479516143.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/minecraft-pe-hacks_GM479516143.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/roblox-skin-free_GM431946152.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/how-many-villages-are-in-coin-master_GM406889139.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/minecraft-java-hacks_GM479516143.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/dominus-roblox-free_GM431946152.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/free-robux-with-no-verification_GM431946152.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/minecraft-xray-hack_GM479516143.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/coin-master-free-coins-twitter_GM406889139.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/minecraft-aimbot_GM479516143.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/minecraft-menu_GM479516143.pdfIn PDF document text
- https://heimatverein-oberlangen.de/images/strucid-aimbot_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000047e2.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x47E2	25724 bytes
SHA-256: `8a5f25e86f39d15f45a345a6364b6d1fba7cd75d8aaba3a2ba0fba1eb930f15a`
`font_01_sfnt_off00008228.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8228	2840 bytes
SHA-256: `3fb127b764b9d10f5525bc4de5ec8316de704409ccb0cf21cff3ad8a30d11676`
`font_02_sfnt_off00008bd9.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8BD9	17712 bytes
SHA-256: `effefb876c7a76aa063811ff0160e46fb8a90dd5507c6c48ef6fa39823ab5c8c`

Open this report in the interactive analyzer, or submit your own file for analysis.