PDF malware analysis — malicious · 6d9a99b8bb939fc2

MALICIOUS

PDF

56.5 KB Created: 2021-05-14 04:31:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: c5171a751082f5c03b6683a0d330f196 SHA-1: 6ac3440ecdca8cd63f6cd54527f308d16ac17b26 SHA-256: 6d9a99b8bb939fc220170e20f1a23e539c1a12bd30a465c64c452b0f904a3ff9

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document contains multiple embedded URLs and a prominent external URI pointing to sites offering game cheats and hacks, indicating a lure for users to download potentially malicious files. The heuristic 'SE_SECRET_RECOVERY_LURE' suggests the document may also attempt to phish for sensitive information like account credentials or private keys under the guise of account recovery. No scripts were extracted, but the presence of multiple malicious-looking URLs and the nature of the lure strongly suggest a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.8128

Heuristics 4

Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE

Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-root-hack-game-hack
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/free-robux-without-verification_GM431946152.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/minecraft-pe-apk-download-free-015-0_GM479516143.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/is-it-possible-to-get-free-robux_GM431946152.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/how-to-win-attack-madness-in-coin-master-hack_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/free-minecraft-gift-card_GM479516143.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/earn-free-robux-today_GM431946152.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/coin-master-free-spins-daily-2021_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/coin-master-free-spins-promo-code_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/coin-master-free-spins-and-coins-blogspot_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/minecraft-reach-hack_GM479516143.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/free-minecraft-com_GM479516143.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/free-robux-without-verification-2021_GM431946152.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/coin-master-hack-xyz_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/optifine-mcpe_GM479516143.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/coin-master-free-codes_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/free-coins-on-coin-master-without-verification_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/coin-master-free-foxy-food_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/coin-master-daily-free-spins-link_GM406889139.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/how-to-hack-peoples-roblox-accounts_GM431946152.pdf
- https://e-learning.mtsduktb.com/__statics/gudangsoal/files/how-to-download-minecraft-for-free_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 5

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004ec2.bin` `2982d278f3ebac5682012a0ce45a86357e4db90ef947526593dbe7553b9f31f6`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4EC2	28516 bytes
`font_01_sfnt_off00008f7c.bin` `e7854aff7cbc8fbdeb85d2b3d6248d12dc820ede8a581f4eac107fa6446c2222`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8F7C	3088 bytes
`font_02_sfnt_off00009a47.bin` `cf7ae5cf6bef3222f5a26bec705b492fed0278aec6b16ec101aeda46e0edd2b2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9A47	7960 bytes
`font_03_sfnt_off0000ad6c.bin` `3314f7b38d470594eaa73d4973565fc6f74845bbaa83b1a4a8a9c9b025514e4b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAD6C	17716 bytes
`font_04_sfnt_off0000cdcf.bin` `fac9a06ceb5574feb8580c075df3ef69dfbd0efa4947186cfe90f11b68eaafb0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xCDCF	4272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.