PDF malware analysis — malicious · 995567c0b3d8c731

MALICIOUS

PDF

45.9 KB Created: 2021-05-17 18:52:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 224c9d2c4e6fbc0c6ff70101148fa599 SHA-1: 096d34e6f7ee2d8f2fa7702dbc1a92cf062c745e SHA-256: 995567c0b3d8c731b09b9adda2ea6b449b077e7331aa615d88ccea2407ff6f7b

142 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious File

This PDF document exhibits characteristics of a malicious lure, specifically employing a 'remote-support tool lure' and a 'download button' heuristic. It contains numerous embedded URLs pointing to sites offering free game-related downloads, such as Minecraft and Robux, which are common pretexts for malware distribution. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

Nyx PDF Classifier malicious score 0.9432

Heuristics 5

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Remote-support tool lure high SE_REMOTE_SUPPORT_LURE

Document instructs the user to install, open, or connect with a remote-support tool such as AnyDesk, TeamViewer, Quick Assist, or ScreenConnect — high-risk in an unsolicited document
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/minecraft-free-download-windows-game-hack
- https://www.cgalgeria-dubai.com/userfiles/files/roebucks-on-roblox_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/how-to-get-free-robux-2021-no-human-verification_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/robux-hack-no-human-verification_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/coin-master-links-2021_GM406889139.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/coin-master-free-coins-and-spins-hack_GM406889139.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/how-to-make-your-own-minecraft-pe-server-for-free_GM479516143.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/free-robux-legit_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/how-to-download-minecraft-for-free-on-pc_GM479516143.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/how-do-you-get-free-robux-on-roblox_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/coin-master-free-2021-spin-link_GM406889139.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/free-robux-net_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/coin-master-hack-apk-july-29_GM406889139.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/how-to-get-free-food-on-coin-master_GM406889139.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/roblox-games-that-give-you-free-robux_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/how-to-get-free-robux-without-verifying_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/mcmaster-club-coin-master-hack_GM406889139.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/free-robux-gift-card-generator_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/free-coins-and-spins-in-coin-master_GM406889139.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/rbxoffers-com-free-robux_GM431946152.pdf
- https://www.cgalgeria-dubai.com/userfiles/files/classic-minecraft-net-hacks_GM479516143.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004bfa.bin` `4fd6ea7e1d0cf8eca0317a1a9c75e887ad3da74fbbfc25de462afbcfc632224b`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4BFA	25616 bytes
`font_01_sfnt_off00008639.bin` `02b35010e2614e3cc95ac6414c49295350c91fdfcc4b4cad27ffdbc10e80df7f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8639	2912 bytes
`font_02_sfnt_off00009036.bin` `01dcb0f2ff627f41b1d4924369c472c3c2df1c4c10fc263e12ce9879fd09d82b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9036	18488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.