PDF malware analysis — malicious · 888c3edf5fade67e

MALICIOUS

PDF

36.0 KB Created: 2021-06-18 10:07:08 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-10-26

MD5: 7e5c42e4e1b4e6866cdd89db7bada9d0 SHA-1: 38980a868a31054e148acb5728b33cd959214bdc SHA-256: 888c3edf5fade67e9ba236edf32c04bfde0798c35585a49d876d5c3ecdb1894b

100 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains embedded links and a visual download button, luring the user to click on a URL that leads to a known malicious redirector. This redirector likely serves a malicious application, as indicated by the ML classifier and the critical heuristic firing. The document body content and numerous URLs suggest a theme of game hacks and cheats, a common lure for distributing malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 3

PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK

PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/479516143/minecraft-pe-0.15-0-apk-free-download-game-hack In PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/hacks-para-roblox-descargar-2021_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-face-750k-sales-roblox_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/rbx-points-get-free-robux-points_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/como-hackear-vehicle-simulator-roblox-para-tener-12000000_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-commands-hack-download_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-shirt-for-kids-free-shipping_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-administrator-badge-hack_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-and-limiteds-hack_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/how-to-get-any-roblox-gamepass-for-free-2021_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/programa-para-hackear-usuuarios-de-roblox_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/get-100-robux-for-free-promo-code_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-hacks-client_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-free-tix-2021_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/free-robux-2021-comxa-dot-com_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/robux-hacks-no-serves_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-ninja-shirt-free_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-prison-life-noclip-hack-2021_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-robux-hack-ohne-handynummer_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/gainblox-gg-free-robux_GM431946152.pdfIn PDF document text
- https://hundt-druck.de/wp-content/uploads/fsqm-files/roblox-online-free-robux_GM431946152.pdfIn PDF document text
- http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off00003252.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x3252	23156 bytes
SHA-256: `f810832b306310f72d762d910c09bd4413ac21db9655622230c76fd78cbc63f9`
`font_01_sfnt_off00006624.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6624	19556 bytes
SHA-256: `601b28722445ea325e82443f7d9f0094d20ca4244c4db4186286535da9b3bc68`

Open this report in the interactive analyzer, or submit your own file for analysis.