PDF malware analysis — malicious · 8a4f56018da4bf32

MALICIOUS

PDF

41.6 KB Created: 2021-05-15 08:10:39 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: e75d7e96eaa405895be7489d2c282b30 SHA-1: d9f933d7d7eb12345dfd2df0f440b3c63d0fbcce SHA-256: 8a4f56018da4bf32bc1c52ef297ad2243dbcc34366271b375b1871c7439ed8fb

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document body and extracted URLs indicate a lure for free game currency (Robux, Coin Master spins) which is a common social engineering tactic. The heuristic 'SE_SECRET_RECOVERY_LURE' suggests the document may attempt to phish for sensitive account credentials or recovery secrets. The presence of embedded URLs points to the document's intent to redirect users to malicious sites, likely to download further malware or steal information.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE

Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/get-free-robux-game-hack
- http://linde-erbach.de/images/game-coin-master-hack_GM406889139.pdf
- http://linde-erbach.de/images/minecraft-svg-images-free_GM479516143.pdf
- http://linde-erbach.de/images/feb-23-2021-free-coin-master-spins_GM406889139.pdf
- http://linde-erbach.de/images/twitter-coin-master-free-spins_GM406889139.pdf
- http://linde-erbach.de/images/coin-master-free-spins-no-generator_GM406889139.pdf
- http://linde-erbach.de/images/coin-master-free-daily-spins-link_GM406889139.pdf
- http://linde-erbach.de/images/free-robux-com-roblox_GM431946152.pdf
- http://linde-erbach.de/images/blox-land-free-robux_GM431946152.pdf
- http://linde-erbach.de/images/how-to-play-minecraft-for-free-on-pc_GM479516143.pdf
- http://linde-erbach.de/images/claim-free-robux_GM431946152.pdf
- http://linde-erbach.de/images/free-spins-coin-master-links-twitter_GM406889139.pdf
- http://linde-erbach.de/images/krnl-download_GM431946152.pdf
- http://linde-erbach.de/images/optifine-pe_GM479516143.pdf
- http://linde-erbach.de/images/free-robux-2021_GM431946152.pdf
- http://linde-erbach.de/images/minecraft-hack-2021_GM479516143.pdf
- http://linde-erbach.de/images/free-roblox-accounts_GM431946152.pdf
- http://linde-erbach.de/images/wahoo-gaming-co-free-robux_GM431946152.pdf
- http://linde-erbach.de/images/free-robux-no-human-verification-or-survey-2021_GM431946152.pdf
- http://linde-erbach.de/images/coin-master-admin-free-spins_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000483c.bin` `90990f09b651e96f95383aa421abfa2be1ea56e397377c4dc48ab16dd9ec770d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x483C	24972 bytes
`font_01_sfnt_off000080cf.bin` `79ac164380d838bf2943c127f808202d45f8751c05dbd036140e6fb9b1b49848`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x80CF	18120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.