PDF malware analysis — malicious · a6908507641effa7

MALICIOUS

PDF

35.1 KB Created: 2021-06-18 08:56:25 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 42a9e4ed10bf8ddc96c35adaad279ad8 SHA-1: ece31b220a78d0a075946f7b86bdd6f4c442315d SHA-256: a6908507641effa7fe769338f2efdb7e952012b5861226197ac3176c171ad34e

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF document contains lures related to game hacks and free items, directing users to download potentially malicious files from external URLs. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded URLs and a 'download button' heuristic indicates a phishing or malware distribution attempt. The document's content and heuristics suggest it's part of a campaign to trick users into downloading further malicious payloads.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE

Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://netcdn.co/app/431946152/impact-hacked-client-roblox-game-hack
- http://library.umuslim.ac.id/repository/roblox-trolling_GM431946152.pdf
- http://library.umuslim.ac.id/repository/how-to-change-your-roblox-username-for-free-2021_GM431946152.pdf
- http://library.umuslim.ac.id/repository/coin-master-free-spins-activegamer_GM406889139.pdf
- http://library.umuslim.ac.id/repository/coin-master-email-rewards-link_GM406889139.pdf
- http://library.umuslim.ac.id/repository/free-robux-in-game-tyoe-your-password_GM431946152.pdf
- http://library.umuslim.ac.id//repository/pubg-uc-4all-cool_GM1330123889.pdf
- http://library.umuslim.ac.id/repository/how-to-give-robux-on-mobile_GM431946152.pdf
- http://library.umuslim.ac.id//repository/how-do-you-hack-roblox_GM431946152.pdf
- http://library.umuslim.ac.id//repository/free-robux-generator-2021_GM431946152.pdf
- http://library.umuslim.ac.id//repository/roblox-free-robux-website_GM431946152.pdf
- http://library.umuslim.ac.id/repository/coin-master-free-spin-and-coin-links_GM406889139.pdf
- http://library.umuslim.ac.id//repository/roblox-18_GM431946152.pdf
- http://library.umuslim.ac.id/repository/free-roblox-gift-card-website_GM431946152.pdf
- http://library.umuslim.ac.id//repository/free-robux-real-working_GM431946152.pdf
- http://library.umuslim.ac.id/repository/roblox-executor-free-download_GM431946152.pdf
- http://library.umuslim.ac.id//repository/actual-free-robux_GM431946152.pdf
- http://library.umuslim.ac.id//repository/coin-master-fan-page-facebook_GM406889139.pdf
- http://library.umuslim.ac.id//repository/coin-master-game-hack-app_GM406889139.pdf
- http://library.umuslim.ac.id/repository/free-diamonds-coin-master_GM406889139.pdf
- http://library.umuslim.ac.id/repository/roblox-island-royale-cheats-for-bucks_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003021.bin` `8d62c24e6865b50a424ea591b288e8bd746e32a04c29764005f561f075b8b26a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3021	22788 bytes
`font_01_sfnt_off000062f4.bin` `2e74a3a9c17529276a44bf1a3892a7ec4d2a6ce691cb73de9f85111f6b79abfe`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x62F4	19488 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.