PDF malware analysis — malicious · 631901391d278a93

MALICIOUS

PDF

43.4 KB Created: 2021-05-17 05:53:47 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: de4fe0139a14e7c15dbbf18b63d234e2 SHA-1: 451a02ebef5178a840c27fd32da5b66696fe9ce3 SHA-256: 631901391d278a939209521f7c53bdeb05af5fb83a0eb61032ddeccb993297a1

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains a large number of external links, many of which are SEO-optimized and point to pages promising game-related hacks or free items. The presence of a "download button" heuristic and the ML classifier's high confidence score indicate malicious intent. The document likely serves as a lure to drive traffic to these malicious sites, potentially for phishing or malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9969

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/play-roblox-free-online-game-hack
- http://lamascheradiferro.dk/images/como-hackear-coin-master-en-espaol_GM406889139.pdf
- http://lamascheradiferro.dk/images/free-minecraft-client_GM479516143.pdf
- http://lamascheradiferro.dk/images/coin-master-hack-using-cheat-engine_GM406889139.pdf
- http://lamascheradiferro.dk/images/free-spins-coin-master-app-iphone_GM406889139.pdf
- http://lamascheradiferro.dk/images/will-minecraft-ever-be-free_GM479516143.pdf
- http://lamascheradiferro.dk/images/free-robux-mod_GM431946152.pdf
- http://lamascheradiferro.dk/images/how-do-you-get-free-coins-in-coin-master_GM406889139.pdf
- http://lamascheradiferro.dk/images/www-free-robux-com_GM431946152.pdf
- http://lamascheradiferro.dk/images/how-to-get-800-robux-for-free_GM431946152.pdf
- http://lamascheradiferro.dk/images/robux-get-com_GM431946152.pdf
- http://lamascheradiferro.dk/images/free-bedrock-minecraft_GM479516143.pdf
- http://lamascheradiferro.dk/images/daily-free-spins-for-coin-master_GM406889139.pdf
- http://lamascheradiferro.dk/images/http-bitly-coin-master-free-2021-spins_GM406889139.pdf
- http://lamascheradiferro.dk/images/free-robux-for-kids-no-verification_GM431946152.pdf
- http://lamascheradiferro.dk/images/roblox-gift-card-free-codes_GM431946152.pdf
- http://lamascheradiferro.dk/images/coin-master-gameplay_GM406889139.pdf
- http://lamascheradiferro.dk/images/minecraft-build-hacks_GM479516143.pdf
- http://lamascheradiferro.dk/images/coin-master-hack-cheat-generator-coins-and-spins-unlimited_GM406889139.pdf
- http://lamascheradiferro.dk/images/coin-master-heaven-free-spins-link_GM406889139.pdf
- http://lamascheradiferro.dk/images/how-to-get-infinite-robux_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004b65.bin` `81b7f5b4a10f0172c95d668eb930cb7783688b697a2132dc39a6ed1109515fed`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4B65	25404 bytes
`font_01_sfnt_off00008672.bin` `0face4c994977258c5b75d4e8d8705768a4ec09c316ae5d82e3d2938a44d0e6e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8672	18628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.