PDF malware analysis — malicious · 551c2451e3024bcc

MALICIOUS

PDF

42.0 KB Created: 2021-05-13 01:05:24 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-24

MD5: be502a448a8ec6efa8361b10879ddcc3 SHA-1: 30747af948f55b63503e64b1973ae5fdfcf875ac SHA-256: 551c2451e3024bcc0439a32fc2f1f4e2da0436b18bc5c1e91717dbb3c3697f74

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains embedded URLs that lead to known malicious redirector infrastructure, specifically pointing to a download for 'wurst-1.12-game-hack'. The document body and numerous extracted URLs suggest a lure for game-related cheats or currency, aligning with social engineering tactics. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/wurst-1.12-game-hack In PDF document text
- https://www.manisoft.ir/images/coin-master-free-blogspot_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/gamehunters-coin-master_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/how-to-get-free-spins-on-coin-master-blogspot_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/free-robux-mobile_GM431946152.pdfIn PDF document text
- https://www.manisoft.ir/images/free-coins-coin-master-2021_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/coin-master-heaven-daily-free-spins_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/coinmaster-spin-ml-link_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/free-account-roblox-with-robux_GM431946152.pdfIn PDF document text
- https://www.manisoft.ir/images/how-to-get-100-robux-for-free_GM431946152.pdfIn PDF document text
- https://www.manisoft.ir/images/coin-master-free-spins-and-free-coins_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/get-free-robux-today_GM431946152.pdfIn PDF document text
- https://www.manisoft.ir/images/coin-master-daily-free-spins-2021_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/can-you-give-me-free-robux_GM431946152.pdfIn PDF document text
- https://www.manisoft.ir/images/coin-master-spin-link-today_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/minecraft-toys-for-free_GM479516143.pdfIn PDF document text
- https://www.manisoft.ir/images/coin-master-free-gifts_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/how-to-use-wurst_GM479516143.pdfIn PDF document text
- https://www.manisoft.ir/images/free-robux-generator-com-roblox-hack_GM431946152.pdfIn PDF document text
- https://www.manisoft.ir/images/coin-master-tricks_GM406889139.pdfIn PDF document text
- https://www.manisoft.ir/images/get-free-robux-info_GM431946152.pdfIn PDF document text
- https://discord.ggIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000049c4.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x49C4	25516 bytes
SHA-256: `735933bf78cfe65f3ca86ec47ab9d49288383924de53a6f04724e3f47c5f04d5`
`font_01_sfnt_off000082f8.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x82F8	17856 bytes
SHA-256: `231ed0e7957a5c445c778f0fe1c9318810f2b5562dc1cd2ae15ff2a5633334db`

Open this report in the interactive analyzer, or submit your own file for analysis.