PDF malware analysis — malicious · 8c04dd77d3d0c02c

MALICIOUS

PDF

47.2 KB Created: 2021-05-12 17:51:09 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 0d7ecf1a00cf603fbe9a5b6a6b8f62ed SHA-1: 554a596d88a17d26d1ebddfdef1b14ec33dd24d8 SHA-256: 8c04dd77d3d0c02c10316136dc35d85e4910279382c5b529593894d18569a8cc

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains multiple embedded URLs, with one specifically pointing to a file download. The critical heuristic 'SE_SECRET_RECOVERY_LURE' indicates the document attempts to trick users into revealing sensitive information like private keys or passwords. This suggests a phishing or credential harvesting attack, likely delivered as a spearphishing attachment.

Machine Learning

Nyx PDF Classifier malicious score 0.8948

Heuristics 4

Recovery secret / private key request critical SE_SECRET_RECOVERY_LURE

Document requests recovery phrases, private keys, backup codes, or saved passwords. Requests for these secrets in a document are high-risk.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/40-free-spins-coin-master-game-hack
- http://apx-centre.ru/images/minecraft-pe-apk_GM479516143.pdf
- http://apx-centre.ru/images/kuso-icu-roblox-hack_GM431946152.pdf
- http://apx-centre.ru/images/free-robux-no-generator_GM431946152.pdf
- http://apx-centre.ru/images/free-minecraft-alts_GM479516143.pdf
- http://apx-centre.ru/images/coin-master-daily-free-spins-link-march-2021_GM406889139.pdf
- http://apx-centre.ru/images/roblox-inappropriate_GM431946152.pdf
- http://apx-centre.ru/images/synapse-roblox-free-download_GM431946152.pdf
- http://apx-centre.ru/images/coin-master-facebook-page_GM406889139.pdf
- http://apx-centre.ru/images/minecraft-servers-that-allow-hacks_GM479516143.pdf
- http://apx-centre.ru/images/how-to-get-to-village-3-in-coin-master_GM406889139.pdf
- http://apx-centre.ru/images/free-coin-master-link-2021_GM406889139.pdf
- http://apx-centre.ru/images/is-minecraft-free-on-mac_GM479516143.pdf
- http://apx-centre.ru/images/girl-roblox-avatar_GM431946152.pdf
- http://apx-centre.ru/images/how-to-get-free-roebucks-in-roblox_GM431946152.pdf
- http://apx-centre.ru/images/hack-free-spin-coin-master_GM406889139.pdf
- http://apx-centre.ru/images/roblox-verification_GM431946152.pdf
- http://apx-centre.ru/images/coin-master-hack-no-human-verification_GM406889139.pdf
- http://apx-centre.ru/images/free-spins-coin-master-2021_GM406889139.pdf
- http://apx-centre.ru/images/coin-master-hack-2021-without-verification_GM406889139.pdf
- http://apx-centre.ru/images/coin-master-hack-apk-april-12-2021_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004872.bin` `50b798d18c2feb688b30e72333e58d60e58a6c30d3afaf013858f4e036d7fd7b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4872	26180 bytes
`font_01_sfnt_off00008497.bin` `d811e0aca85f3b94c42cd1240eec68b8eb378f3d8be5e408d3f6abd0f11f834d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8497	7332 bytes
`font_02_sfnt_off000096af.bin` `adc3b494d1fa0974f6acdf3c8a88f4cec1eca3c3c07b4c24b7a089c53791e33f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x96AF	18120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.