PDF malware analysis — malicious · a5bddd97a4231b89

MALICIOUS

PDF

42.7 KB Created: 2021-05-15 16:22:31 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 2225279f73759b60adb9eb6279597c18 SHA-1: e784f7a14612a48c00a0653beb238c52f68a01b5 SHA-256: a5bddd97a4231b89a8613617624e202b654ecdfa7814376243b992e9edb547a6

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document contains numerous links to external websites, many of which are structured as SEO-optimized PDF gateways. The document body and extracted URLs suggest a lure for free game items or hacks, likely leading to malware downloads or phishing. The ML classifier strongly indicated maliciousness, and the PDF structure points to a link farm designed to distribute malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/479516143/how-to-get-minecraft-for-free-on-xbox-360-game-hack
- https://www.fubode.org/images/is-minecraft-free-on-pc_GM479516143.pdf
- https://www.fubode.org/images/minecraft-hack-2021_GM479516143.pdf
- https://www.fubode.org/images/rblx-city-free-robux_GM431946152.pdf
- https://www.fubode.org/images/free-coins-coin-master-link-2021_GM406889139.pdf
- https://www.fubode.org/images/free-robux-hack-us_GM431946152.pdf
- https://www.fubode.org/images/how-to-make-a-minecraft-pe-server-for-free_GM479516143.pdf
- https://www.fubode.org/images/how-to-hack-a-minecraft-account_GM479516143.pdf
- https://www.fubode.org/images/coin-master-free-spins-and-coins-app_GM406889139.pdf
- https://www.fubode.org/images/coin-master-free-spins-link-2021_GM406889139.pdf
- https://www.fubode.org/images/free-robux-no-human-verification-or-survey-or-download-2021_GM431946152.pdf
- https://www.fubode.org/images/free-robux-generator-com-roblox-hack_GM431946152.pdf
- https://www.fubode.org/images/coin-master-hack-version-ios_GM406889139.pdf
- https://www.fubode.org/images/how-to-get-free-roblox-items_GM431946152.pdf
- https://www.fubode.org/images/coin-master-free-cards-link_GM406889139.pdf
- https://www.fubode.org/images/coin-master-spin-hack_GM406889139.pdf
- https://www.fubode.org/images/how-to-hack-roblox-2021_GM431946152.pdf
- https://www.fubode.org/images/minecraft-free-download-windows_GM479516143.pdf
- https://www.fubode.org/images/coin-master-hack-pc-download_GM406889139.pdf
- https://www.fubode.org/images/bux-gg-robux-free_GM431946152.pdf
- https://www.fubode.org/images/codes-how-to-get-free-robux_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004a50.bin` `f276d6b3b5459e7cb653b0ecc6606e83efd33b2dbc5677263929f668cf76b6cb`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4A50	25028 bytes
`font_01_sfnt_off00008260.bin` `f47c6db87afe0eab762f9c642f79da0b31915930cbe30facc3d257340af03a9d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8260	18984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.