PDF malware analysis — malicious · 627af617b96df0fb

MALICIOUS

PDF

42.1 KB Created: 2021-05-13 22:37:46 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 3a924cc9b50438f91570522bf077d086 SHA-1: 4249ddb2dcbdd99ea7f0861e42e064b2cc375707 SHA-256: 627af617b96df0fbea8ebf13696b005526e9b8ba883112c60420a1c894c97312

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains multiple embedded URLs and a high-confidence ML classification indicating malicious intent. The document body and extracted URLs suggest a lure for downloading game hacks, which is a common tactic for distributing malware. The presence of a raw IP address in a clickable URI further increases the suspicion of malicious activity.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL

PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-hack-no-survey-or-verification-game-hack
- http://217.165.206.12/userfiles/files/coin-master-free-spins-link-may-2021_GM406889139.pdf
- http://217.165.206.12/userfiles/files/coin-master-attack-block-hack_GM406889139.pdf
- http://217.165.206.12/userfiles/files/get-free-spins-for-coin-master_GM406889139.pdf
- http://217.165.206.12/userfiles/files/free-spins-coin-master-hack-2021_GM406889139.pdf
- http://217.165.206.12/userfiles/files/free-coins-and-spins-in-coin-master_GM406889139.pdf
- http://217.165.206.12/userfiles/files/minecraft-free-install_GM479516143.pdf
- http://217.165.206.12/userfiles/files/roblox-admin-hack_GM431946152.pdf
- http://217.165.206.12/userfiles/files/coin-master-free-coin-hack_GM406889139.pdf
- http://217.165.206.12/userfiles/files/a-lot-of-robux_GM431946152.pdf
- http://217.165.206.12/userfiles/files/coin-master-hack-100-working_GM406889139.pdf
- http://217.165.206.12/userfiles/files/how-to-get-free-robux-no-verification_GM431946152.pdf
- http://217.165.206.12/userfiles/files/how-to-get-free-robux-hack_GM431946152.pdf
- http://217.165.206.12/userfiles/files/how-to-hack-someones-roblox-account-2021_GM431946152.pdf
- http://217.165.206.12/userfiles/files/coin-master-free-spins-link-2021_GM406889139.pdf
- http://217.165.206.12/userfiles/files/game-give-free-robux_GM431946152.pdf
- http://217.165.206.12/userfiles/files/blogspot-coin-master-spins_GM406889139.pdf
- http://217.165.206.12/userfiles/files/minecraft-java-server-hosting-free_GM479516143.pdf
- http://217.165.206.12/userfiles/files/minecraft-client_GM479516143.pdf
- http://217.165.206.12/userfiles/files/toolbox-apk_GM479516143.pdf
- http://217.165.206.12/userfiles/files/roblox-skins-boy-free_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004a2b.bin` `f1f4d93ca96babbfc9c7d842a6c532d7b6067237e32b914b6d1901e8caa70599`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4A2B	25500 bytes
`font_01_sfnt_off000081f0.bin` `11bfbc115034705528bf6e10e44e61aa29d499e253164c4385166f501b43b311`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x81F0	18284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.