PDF malware analysis — malicious · 982dce83a63d9ceb

MALICIOUS

PDF

43.7 KB Created: 2021-05-15 15:36:42 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 306b67f1a4b9f0722f97a2993f199e97 SHA-1: c9ed2f94408d52c3dde5212c4d1a89f146229cb1 SHA-256: 982dce83a63d9ceb649445f937d353d85f0665a094008a8c0c1672f921c4a791

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple embedded links pointing to external resources, including one that uses a raw IP address. These links are presented as download opportunities for game-related hacks and currency, indicating a lure to download further malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a phishing or malware distribution attempt.

Machine Learning

Nyx PDF Classifier malicious score 0.9969

Heuristics 4

Clickable URI points to raw IP address medium PDF_URI_IP_LITERAL

PDF contains a clickable HTTP(S) action whose host is a literal IPv4 address. Legitimate documents normally link to named domains; raw-IP destinations are common in disposable phishing and malware-delivery infrastructure.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/coin-master-blogspot-game-hack
- http://118.174.0.244/UserFiles/File/free-robux-websites-2021_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/getrobux-now_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/coinmaster-spin-ml-free_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/coin-master-apk-hack-35-8_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/free-spins-and-coins-coin-master-app_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/free-spin-coin-master-2021_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/coin-master-coins-free_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/coin-master-free-spins-1701-20_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/free-spins-in-coin-master-without-human-verification_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/get-free-robux-without-doing-anything_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/google-coin-master-free-spins_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/you-promised-my-son-free-robux_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/free-robux-games-that-actually-work_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/free-coin-master-hacks-no-verification-or-survey_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/free-shirt-templates-roblox_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/moonactive-free-spins_GM406889139.pdf
- http://118.174.0.244/UserFiles/File/roblox-generator-no-human-verification_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/roblox-controversy_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/roblox-apk-hack_GM431946152.pdf
- http://118.174.0.244/UserFiles/File/coin-master-100-spin-slot_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004a70.bin` `bbd2ebb65abd1ad619398f85497c502883e940d10f4d2fda7824d2c9608befb5`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4A70	29696 bytes
`font_01_sfnt_off00008851.bin` `856755575c1a7459373c524fcaf021c967fba3d5c4d4b4c6d782a1862ea9e167`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8851	18300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.