PDF malware analysis — malicious · 62fab8a94b1a4496

MALICIOUS

PDF

42.4 KB Created: 2021-05-16 02:41:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: aebabb353037389c9f82a22083724636 SHA-1: 8d699af0f64da987c3caa4dac5bbcc23db49fa82 SHA-256: 62fab8a94b1a449657b0ab22e667b890e922298224d74408fa6c776959f5f282

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs and a call-to-action button, strongly suggesting a phishing or malware distribution attempt. The ML classifier also flagged this PDF with high confidence. The document body and extracted URLs indicate a lure related to game "hacks" and "free coins", likely leading to the download of further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL

PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-free-coins-generator-game-hack
- http://1.179.208.67/ckfinder/userfiles/files/how-to-hack-a-roblox-account-easy_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/free-gifts-coin-master_GM406889139.pdf
- http://1.179.208.67/ckfinder/userfiles/files/hacks-for-minecraft-bedrock_GM479516143.pdf
- http://1.179.208.67/ckfinder/userfiles/files/roblox-free-roblox_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/oprewards-free-robux_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/coin-master-free-daily-spins-today_GM406889139.pdf
- http://1.179.208.67/ckfinder/userfiles/files/robloxfun-com-generator_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/huskybuckscom-free-robux_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/coin-master-free-spins-cheat_GM406889139.pdf
- http://1.179.208.67/ckfinder/userfiles/files/rbx-gg-free-robux_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/roblox-apk-hack_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/free-minecraft-shaders_GM479516143.pdf
- http://1.179.208.67/ckfinder/userfiles/files/give-me-robux-now_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/free-robux-download_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/get-free-robux_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/roblox-hack-generator_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/coin-master-hack-100-working_GM406889139.pdf
- http://1.179.208.67/ckfinder/userfiles/files/robux-generator-without-verification_GM431946152.pdf
- http://1.179.208.67/ckfinder/userfiles/files/minecraft-hack-client-download_GM479516143.pdf
- http://1.179.208.67/ckfinder/userfiles/files/coin-master-spin-free_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004c6f.bin` `7d6687873af587ce2bc72225b607d3f968cdf69eaae6243bfe9ac7dd473191b5`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4C6F	25460 bytes
`font_01_sfnt_off00008552.bin` `f6b7bbb27796bfdd91832c5c9631b2ef3c604ec4967bc220e21b541acce31e79`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8552	17712 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.