PDF malware analysis — malicious · a32093f95c606aeb

MALICIOUS

PDF

42.1 KB Created: 2021-05-16 07:05:07 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 200df2733ed3b95c80a26548130b71a8 SHA-1: d5dfa771a52bb896ff880a396999fe20f3df9f7e SHA-256: a32093f95c606aeb8aa55cf11eeb313408b8179198d46a972460feb87963109c

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains heuristics indicating it is malicious and uses a payment redirection lure, suggesting a scam. The embedded URL and numerous other URLs point to sites offering free game currency or hacks, which is a common lure for phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URLs strongly suggest an attempt to trick the user into downloading a malicious payload.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE

Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/free-roblox-app-game-hack
- https://datavoiz.com/images/robux-com-free_GM431946152.pdf
- https://datavoiz.com/images/earn-free-robux-for-roblox_GM431946152.pdf
- https://datavoiz.com/images/games-that-give-you-free-robux_GM431946152.pdf
- https://datavoiz.com/images/coin-master-free-spin-generator-without-human-verification_GM406889139.pdf
- https://datavoiz.com/images/roblox-girl-avatar_GM431946152.pdf
- https://datavoiz.com/images/free-coin-master-spins-2021_GM406889139.pdf
- https://datavoiz.com/images/free-robux-for-free_GM431946152.pdf
- https://datavoiz.com/images/coin-master-free-spins-hack-no-human-verification_GM406889139.pdf
- https://datavoiz.com/images/roblox-phantom-forces-hack_GM431946152.pdf
- https://datavoiz.com/images/coin-master-free-spin-today_GM406889139.pdf
- https://datavoiz.com/images/do-coin-master-hacks-work_GM406889139.pdf
- https://datavoiz.com/images/hacks-for-minecraft-windows-10_GM479516143.pdf
- https://datavoiz.com/images/free-card-collection-in-coin-master_GM406889139.pdf
- https://datavoiz.com/images/coin-master-unlimited-coins-hack-apk-download_GM406889139.pdf
- https://datavoiz.com/images/coin-master-free-spins-today-daily-links_GM406889139.pdf
- https://datavoiz.com/images/roblox-generator-com_GM431946152.pdf
- https://datavoiz.com/images/coin-master-free-coins-and-spins-link_GM406889139.pdf
- https://datavoiz.com/images/minecraft-auto-miner-hack_GM479516143.pdf
- https://datavoiz.com/images/free-robux-no-human-verification-or-survey_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000047da.bin` `5125ae497a6cbf34e424a102137425383b82e6eb8942e77705e63adc87cadc84`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x47DA	25304 bytes
`font_01_sfnt_off0000826e.bin` `b55918b8480f66a9a053d61f951430dbcd2a64ad9c4d9286342bad064f4e5d72`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x826E	18124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.