PDF malware analysis — malicious · a2ce5405404db03b

MALICIOUS

PDF

41.8 KB Created: 2021-05-15 11:52:26 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 18b3fbdfd768c0db1e5bdfd05b582cf6 SHA-1: d3e5a9be61042827cf52a838aa452ce6a3d876c9 SHA-256: a2ce5405404db03b22eff0d48e85f3a7c0f2884649dac5105f2817d362fd053e

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains multiple embedded URLs and a visual download button, strongly suggesting an attempt to trick the user into downloading a second-stage payload. The ML classifier also flagged this PDF as malicious with high confidence. The document's content and embedded links point towards a lure for game-related downloads, which is a common tactic for distributing malware.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Callback phishing phone lure medium SE_CALLBACK_LURE

Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/free-minecraft-shaders-game-hack
- http://1a-vermietung.com/images/coin-master-games-download-free_GM406889139.pdf
- http://1a-vermietung.com/images/minecraft-windows-10-free_GM479516143.pdf
- http://1a-vermietung.com/images/free-robux-android_GM431946152.pdf
- http://1a-vermietung.com/images/how-to-play-minecraft-for-free-on-computer_GM479516143.pdf
- http://1a-vermietung.com/images/how-to-get-free-robux-without-verification-2021_GM431946152.pdf
- http://1a-vermietung.com/images/coin-master-daily-free-spins-link-today-2021_GM406889139.pdf
- http://1a-vermietung.com/images/coin-master-mod-version-free-download-ios_GM406889139.pdf
- http://1a-vermietung.com/images/freerobuxhack-us_GM431946152.pdf
- http://1a-vermietung.com/images/free-robux-generator_GM431946152.pdf
- http://1a-vermietung.com/images/free-robux-kid-friendly-no-human-verification_GM431946152.pdf
- http://1a-vermietung.com/images/roblox-hack-codes_GM431946152.pdf
- http://1a-vermietung.com/images/wurst-18_GM479516143.pdf
- http://1a-vermietung.com/images/spin-links-for-coin-master_GM406889139.pdf
- http://1a-vermietung.com/images/free-coin-master-spins-2021_GM406889139.pdf
- http://1a-vermietung.com/images/no-verification-coin-master-hack_GM406889139.pdf
- http://1a-vermietung.com/images/free-spins-on-coin-master-2021_GM406889139.pdf
- http://1a-vermietung.com/images/how-to-get-minecraft-windows-10-for-free-2021_GM479516143.pdf
- http://1a-vermietung.com/images/earn-robux-sites_GM431946152.pdf
- http://1a-vermietung.com/images/free-game-pack-with-google-play-coin-master_GM406889139.pdf
- http://1a-vermietung.com/images/master-coin-free-spin-daily_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004ae1.bin` `0bd12131978387f59fd3e0799f26dc8da3d1585e5f6d1344955d3e0dcaab7396`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4AE1	24484 bytes
`font_01_sfnt_off00008246.bin` `35d3f4bf4307bd8a3f315663bc97638986f3fc82832bfbc69b2a41c23e708d7a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8246	17908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.