PDF malware analysis — malicious · 66b4430dce5f5446

MALICIOUS

PDF

33.2 KB Created: 2021-07-04 12:07:53 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 46b08ad4ed632642a6716ad515a1ab97 SHA-1: 6da4375761121482bed471686cdb3d97726a583c SHA-256: 66b4430dce5f544602658a96ff2c389eedcd231a4d64382e0203981ca8ab07b7

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded URLs and a call-to-action phrase, masquerading as hacks for popular games like Minecraft and Roblox. The ML classifier strongly indicated maliciousness, and the presence of multiple URIs pointing to potentially malicious content suggests a phishing or malware distribution attempt. No scripts were extracted from this sample, but the document's structure and content are designed to trick users into clicking malicious links.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL

PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/479516143/minecraft-server-hacks-game-hack
- http://36.94.36.7/elib/repository/roblox-com-hack_GM431946152.pdf
- http://36.94.36.7/elib//repository/freespinandcoin-blogspot_GM406889139.pdf
- http://36.94.36.7/elib/repository/free-robux-in-a-second_GM431946152.pdf
- http://36.94.36.7/elib//repository/free-coin-master-spins-and-coins_GM406889139.pdf
- http://36.94.36.7/elib/repository/free-robux-generator_GM431946152.pdf
- http://36.94.36.7/elib/repository/free-spins-coin-master-hack-2021_GM406889139.pdf
- http://36.94.36.7/elib//repository/free-robux-com-roblox_GM431946152.pdf
- http://36.94.36.7/elib/repository/how-to-get-roebucks_GM431946152.pdf
- http://36.94.36.7/elib/repository/free-robux-gift-card-codes_GM431946152.pdf
- http://36.94.36.7/elib/repository/800-free-robux-2021_GM431946152.pdf
- http://36.94.36.7/elib/repository/is-minecraft-bedrock-free_GM479516143.pdf
- http://36.94.36.7/elib//repository/roblox-earn_GM431946152.pdf
- http://36.94.36.7/elib//repository/how-to-get-free-food-for-foxy-in-coin-master_GM406889139.pdf
- http://36.94.36.7/elib/repository/how-to-use-hacked-word-generators-on-roblox_GM431946152.pdf
- http://36.94.36.7/elib/repository/coin-master-spins-hack-iphone_GM406889139.pdf
- http://36.94.36.7/elib/repository/coin-master-computer-hack_GM406889139.pdf
- http://36.94.36.7/elib/repository/coin-master-free-spins-and-coins-generator_GM406889139.pdf
- http://36.94.36.7/elib/repository/hacking-tools-roblox-2021_GM431946152.pdf
- http://36.94.36.7/elib/repository/minecraft-cracked-client_GM479516143.pdf
- http://36.94.36.7/elib/repository/free-spins-coins-coin-master_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002e5a.bin` `9ef1c827b50aa22240246338b5afd8c0c530ba4cae6c0aa8a4479109f865d088`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2E5A	22288 bytes
`font_01_sfnt_off00005f65.bin` `71f7a85a41a8a6a6a2c32c2943b48c9b52068ac0158ebdb661ca44d474d09a7b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5F65	18140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.