PDF malware analysis — malicious · 6e444fe55c220c54

MALICIOUS

PDF

34.0 KB Created: 2021-07-01 22:47:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 548f8a3efd47b7765fdce8c624a5209e SHA-1: d101f9a52b257e269a6ab0505b7d482c2df6f19e SHA-256: 6e444fe55c220c5409f6e7b9e9d121ea9fdb90523bc1e34efca8fc00ca8fd9f5

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a visual download button lure, aiming to trick users into downloading further malicious content. The ML classifier strongly indicates maliciousness, and the presence of external URIs suggests a download or redirection attempt. No scripts were extracted from this sample, but the overall structure and embedded links point to a downloader or dropper functionality.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL

PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/hack-vehicle-tycoon-roblox-codes-game-hack
- http://118.174.0.244/UserFiles/File/roblox-hack-2021-lev-7_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/free-minecraft-maps_GM479516143.pdf
- http://118.174.0.244/UserFiles/File/wikihow-how-to-hack-someones-roblox-account_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/free-vip-server-roblox-saber-simulator_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/gametest-roblox-robux-hack_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/earn-robux-for-roblox_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/minecraft-anarchy-server-no-hacks_GM479516143.pdf
- http://118.174.0.244/UserFiles/File/free-roblox-avatar-ideas_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/coin-master-free-spin-whatsapp-group-link_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/robux-free-robux_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/get-follower-tiktok-free_GM835599320.pdf
- http://118.174.0.244/UserFiles/File/get-free-robux-today-com_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/collect-free-spins-coin-master_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/robuxy-com-free-robux_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/robux-card-hack-pastebin_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/free-coin-master-spins-blogger_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/coin-master-deals_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/free-robux-codes-2021_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/free-robux-generator-2021_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/coin-monster_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002e5f.bin` `516c276c468e0a3ce08c5cbf5c85c2448b62dd6f3c696c182296e2717094b0ae`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2E5F	21768 bytes
`font_01_sfnt_off00005e8c.bin` `aadd3306ccdbec09d31816e5d2fb4ae15fc91ca5cec7fa27d5295fc45823a34e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5E8C	19428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.