PDF malware analysis — malicious · 39e253a86fdc7361

MALICIOUS

PDF

42.2 KB Created: 2021-05-13 10:03:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27

MD5: 375128992cbb5423d1073da5bd58f9c2 SHA-1: 99d46aa70e3414565ec5ee1211259fd37e9c8387 SHA-256: 39e253a86fdc7361d1a10cb35859a0dbd2f21d940f996e74f6ef2da1afd038e0

90 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document exhibits characteristics of a malicious lure, specifically a fake invoice or payment scam, and a remote-support tool pretext. It contains multiple embedded URLs pointing to sites offering game hacks and cheats, suggesting an attempt to trick users into downloading malware or engaging in fraudulent activities. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 5

Remote-support tool lure high SE_REMOTE_SUPPORT_LURE

Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
Fake invoice / payment lure low SE_INVOICE_LURE

Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/free-minecraft-bedrock-server-game-hack PDF link annotation
- https://zabota-kashira.ru/images/cm-spin-link_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/free-minecraft-account-list_GM479516143.pdfIn PDF document text
- https://zabota-kashira.ru/images/coin-master-hack-pc-2021_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/minecraft-hack-app_GM479516143.pdfIn PDF document text
- https://zabota-kashira.ru/images/free-spin-coin-master-new-link_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/robux-hack-2021_GM431946152.pdfIn PDF document text
- https://zabota-kashira.ru/images/coin-master-hack-program_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/free-coin-master-androd-cheats-2021_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/minecraft-java-edition-download-free_GM479516143.pdfIn PDF document text
- https://zabota-kashira.ru/images/coin-master-free-daily-spins-link-2021_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/coin-master-hack-2021-no-human-verification_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/roblox-hack-unlimited-robux_GM431946152.pdfIn PDF document text
- https://zabota-kashira.ru/images/coin-master-free-spins-link-download_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/coin-master-spin-free_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/roblox-t-shirt-free_GM431946152.pdfIn PDF document text
- https://zabota-kashira.ru/images/minecraft-free-install_GM479516143.pdfIn PDF document text
- https://zabota-kashira.ru/images/robux-hack-me_GM431946152.pdfIn PDF document text
- https://zabota-kashira.ru/images/how-to-get-free-robux-2021-easy_GM431946152.pdfIn PDF document text
- https://zabota-kashira.ru/images/coin-master-hack-spins-android_GM406889139.pdfIn PDF document text
- https://zabota-kashira.ru/images/roblox-mobile-hack_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004a9b.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4A9B	24940 bytes
SHA-256: `ef90911e6e39dc49b24a633f3bc5cd84503ca8aa798a9295ed276f16a8ee305d`
`font_01_sfnt_off00008275.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8275	18384 bytes
SHA-256: `91126a517b1f6fe08fde59393e56e1de7cf034d0066f3393bf7fbc33808ed0e4`

Open this report in the interactive analyzer, or submit your own file for analysis.