PDF malware analysis — malicious · 432a42b3f80e35e2

MALICIOUS

PDF

43.3 KB Created: 2021-05-12 11:30:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 04ac656bef086088167afc430aaca7ee SHA-1: 6c01357bee51ac5a1cf39588c6a0012660213837 SHA-256: 432a42b3f80e35e24db842b37f429d24d2a803f7974a7623d1a9ea7369c6c089

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF contains a large number of external links, many of which are SEO-optimized and point to sites offering game hacks and cheats. The document body and extracted URLs suggest a lure for users seeking in-game currency or exploits, likely leading to malicious websites. The ML classifier strongly indicated maliciousness, and the PDF structure with numerous external links is a common tactic for distributing malware or phishing content.

Machine Learning

Nyx PDF Classifier malicious score 0.9969

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/how-to-get-free-spins-on-coin-master-2021-iphone-game-hack
- http://moneymaker-gold.de/files/how-to-get-free-robux-no-human-verification_GM431946152.pdf
- http://moneymaker-gold.de/files/how-to-get-free-robux-hack-2021_GM431946152.pdf
- http://moneymaker-gold.de/files/can-you-really-hack-coin-master_GM406889139.pdf
- http://moneymaker-gold.de/files/minecraft-hacks-115-2_GM479516143.pdf
- http://moneymaker-gold.de/files/how-to-get-free-robux-2021_GM431946152.pdf
- http://moneymaker-gold.de/files/coin-master-hack-apk-free-download_GM406889139.pdf
- http://moneymaker-gold.de/files/hack-to-protect-village-on-coin-master_GM406889139.pdf
- http://moneymaker-gold.de/files/hack-coin-master-ios-download_GM406889139.pdf
- http://moneymaker-gold.de/files/free-star-codes-roblox_GM431946152.pdf
- http://moneymaker-gold.de/files/moonactive-coin-master-free-spins-link_GM406889139.pdf
- http://moneymaker-gold.de/files/can-i-get-free-robux_GM431946152.pdf
- http://moneymaker-gold.de/files/how-do-you-earn-robux_GM431946152.pdf
- http://moneymaker-gold.de/files/minecraft-complete-handbook_GM479516143.pdf
- http://moneymaker-gold.de/files/coin-master-free-spins-app_GM406889139.pdf
- http://moneymaker-gold.de/files/coin-master-spin-link-free-download_GM406889139.pdf
- http://moneymaker-gold.de/files/can-you-make-a-minecraft-server-for-free_GM479516143.pdf
- http://moneymaker-gold.de/files/coin-master-free-spins-link-download_GM406889139.pdf
- http://moneymaker-gold.de/files/cmaster-club-coin-master-hack_GM406889139.pdf
- http://moneymaker-gold.de/files/coin-master-free-spins-hack_GM406889139.pdf
- http://moneymaker-gold.de/files/free-coin-master-coins_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004835.bin` `1c76f8eb78cc46ea48c4200ecd9b6cc39009d3a345988b36bdfdff431915f8ae`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4835	27280 bytes
`font_01_sfnt_off0000860b.bin` `40c475c53aff331210a9a2d0b75aea6a35c2112271575a9f9d5a0db1381ffa81`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x860B	18620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.