PDF malware analysis — malicious · 412f708d124847cc

MALICIOUS

PDF

43.1 KB Created: 2021-05-16 04:12:31 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 5b3bdf141799c755260186525fd37b5e SHA-1: 6429f31124282a417208e25580ec6cd949f51688 SHA-256: 412f708d124847cc6aa6bbc2f22b8c29c27e5bf25af3a36aa2f39cf9e6af64ba

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document exhibits characteristics of an advance-fee scam, using lottery or prize language combined with parcel delivery requirements to trick the user. It contains an embedded URI pointing to a potentially malicious download, and the ML classifier strongly indicates maliciousness. The document's structure and embedded URLs suggest it is designed to deliver a second-stage payload, likely through a link that prompts a download.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE

Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/roblox-games-free-game-hack
- http://www.teapotjewelry.com/images/minecraft-bedrock-edition-pc-download-free_GM479516143.pdf
- http://www.teapotjewelry.com/images/coin-coin-master-hack_GM406889139.pdf
- http://www.teapotjewelry.com/images/lazyblocks-com-free-robux_GM431946152.pdf
- http://www.teapotjewelry.com/images/how-to-get-free-spins-in-coin-master-2021_GM406889139.pdf
- http://www.teapotjewelry.com/images/free-coin-master-coins_GM406889139.pdf
- http://www.teapotjewelry.com/images/coin-master-free-spins-link-iphone_GM406889139.pdf
- http://www.teapotjewelry.com/images/coin-master-free-spins-hack_GM406889139.pdf
- http://www.teapotjewelry.com/images/free-robux-quiz_GM431946152.pdf
- http://www.teapotjewelry.com/images/how-to-sue-roblox_GM431946152.pdf
- http://www.teapotjewelry.com/images/free-premium-roblox_GM431946152.pdf
- http://www.teapotjewelry.com/images/robux-hack-no-human-verification_GM431946152.pdf
- http://www.teapotjewelry.com/images/free-outfits-roblox_GM431946152.pdf
- http://www.teapotjewelry.com/images/free-robux-no-survey-or-human-verification_GM431946152.pdf
- http://www.teapotjewelry.com/images/how-to-make-clothes-on-roblox-for-free_GM431946152.pdf
- http://www.teapotjewelry.com/images/free-spin-coin-master-hack-2021_GM406889139.pdf
- http://www.teapotjewelry.com/images/free-spin-coin-master-2021-link_GM406889139.pdf
- http://www.teapotjewelry.com/images/coin-master-free-spins-link-2021-today_GM406889139.pdf
- http://www.teapotjewelry.com/images/vip-roblox-free_GM431946152.pdf
- http://www.teapotjewelry.com/images/roblox-dominus-free_GM431946152.pdf
- http://www.teapotjewelry.com/images/coin-master-today_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000049cb.bin` `83cf7123cff15ad1cfa50075cf9a390ed2d7249e09448a869cfdbc9d59eb97d5`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x49CB	26536 bytes
`font_01_sfnt_off000085ac.bin` `c854a6c24cd9397543535c319deb2c67afb6e9d7a93f095be0a0206a19e96549`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x85AC	18436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.