PDF malware analysis — malicious · 74d460f6512522e2

MALICIOUS

PDF

36.1 KB Created: 2021-07-05 16:26:22 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: ea6cc4de908c65ee901f75fcfe94bb56 SHA-1: 6f27a8577bc188d0dff93b6bbdd023fb1a34c04f SHA-256: 74d460f6512522e2589ad3a3fbc048aad51c3cabf41e53a07838b9f017c71a14

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains numerous embedded links to external websites, many of which are structured as a link farm for SEO purposes. The primary URL, http://netcdn.tw/app/406889139/hack-coin-master-app-ios-game-hack, suggests a lure for downloading applications, likely malicious. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.tw/app/406889139/hack-coin-master-app-ios-game-hack
- https://opac.heritagejkt.org/repository/free-robux-aout-2021_GM431946152.pdf
- https://opac.heritagejkt.org//repository/roblox-exploit-download_GM431946152.pdf
- https://opac.heritagejkt.org/repository/how-to-get-free-coins-for-coin-master_GM406889139.pdf
- https://opac.heritagejkt.org/repository/how-to-win-free-robux_GM431946152.pdf
- https://opac.heritagejkt.org/repository/free-robux-legit-2021-no-survey_GM431946152.pdf
- https://opac.heritagejkt.org/repository/roblox-free-robux-no-verification_GM431946152.pdf
- https://opac.heritagejkt.org/repository/free-robux-no-verify_GM431946152.pdf
- https://opac.heritagejkt.org/repository/how-to-get-free-robux-nicsterv_GM431946152.pdf
- https://opac.heritagejkt.org/repository/cbro-roblox-funds-hacks_GM431946152.pdf
- https://opac.heritagejkt.org/repository/escape-room-roblox-cheats-enchanted-forest-secret-password_GM431946152.pdf
- https://opac.heritagejkt.org/repository/free-roblox-battle-royale_GM431946152.pdf
- https://opac.heritagejkt.org/repository/how-to-hack-on-roblox-account-theft_GM431946152.pdf
- https://opac.heritagejkt.org/repository/how-to-get-free-robux-hack-on-a-tablet_GM431946152.pdf
- https://opac.heritagejkt.org/repository/how-to-run-roblox-hacks-on-school-pc_GM431946152.pdf
- https://opac.heritagejkt.org/repository/free-lvl-7-roblox-exploit_GM431946152.pdf
- https://opac.heritagejkt.org/repository/get-free-robux-gg_GM431946152.pdf
- https://opac.heritagejkt.org//repository/free-minecraft-games-for-kids_GM479516143.pdf
- https://opac.heritagejkt.org/repository/free-roblox-usernames-and-passwords-not-changeable_GM431946152.pdf
- https://opac.heritagejkt.org/repository/free-coins-and-spins-coin-master-2021_GM406889139.pdf
- https://opac.heritagejkt.org/repository/roblox-hack-robux-cheat-engine-64_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off0000344b.bin` `190625ea1e84c5578a1735b87933a51e082b06a10d855c299f10df61441ad5c4`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x344B	23948 bytes
`font_01_sfnt_off00006abc.bin` `92885cdb40844dabedcd789cc0fdc1dae3095a00aebbb69c69b4668ac08d7e62`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6ABC	18180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.