PDF malware analysis — malicious · b16f13a749aee20f

MALICIOUS

PDF

41.4 KB Created: 2021-05-20 05:23:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 2db0282403d657f797d6ad9560930d3a SHA-1: d93988ff7ff551b5dcd9e43e67c22d4eb106c582 SHA-256: b16f13a749aee20f86f8582944501c9a428ed42d42345698d2b8e140beb1c977

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The document exhibits characteristics of an advance-fee scam, using game-related lures to entice users to click on embedded links. The primary link, https://netcdn.xyz/app/1330123889/pubg-uc-buy-in-pakistan-jazz-cash-game-hack, likely leads to a malicious download or phishing page. While no scripts were directly extracted, the PDF structure and embedded links suggest a workflow designed to exploit user interest in online games for fraudulent purposes.

Machine Learning

Nyx PDF Classifier malicious score 0.9971

Heuristics 4

Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE

Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/1330123889/pubg-uc-buy-in-pakistan-jazz-cash-game-hack
- https://ccej.lviv.ua/images/roblox-fun-com-free-robux_GM431946152.pdf
- https://ccej.lviv.ua/images/free-robux-no-human-verification-generator_GM431946152.pdf
- https://ccej.lviv.ua/images/coin-master-free-spin-and-coin-link-haktuts-hacking-news_GM406889139.pdf
- https://ccej.lviv.ua/images/coin-master-daily-free-spins-and-coins-link_GM406889139.pdf
- https://ccej.lviv.ua/images/how-to-become-a-hacker-in-roblox_GM431946152.pdf
- https://ccej.lviv.ua/images/minecraft-for-chromebook-free_GM479516143.pdf
- https://ccej.lviv.ua/images/minecraft-free-no-virus_GM479516143.pdf
- https://ccej.lviv.ua/images/free-coin-master-coins_GM406889139.pdf
- https://ccej.lviv.ua/images/coin-master-free-attack_GM406889139.pdf
- https://ccej.lviv.ua/images/how-to-play-minecraft-online-for-free_GM479516143.pdf
- https://ccej.lviv.ua/images/how-to-download-minecraft-for-free-on-windows-10_GM479516143.pdf
- https://ccej.lviv.ua/images/coin-master-free-cards-2021_GM406889139.pdf
- https://ccej.lviv.ua/images/mcpe_GM479516143.pdf
- https://ccej.lviv.ua/images/free-coin-master-gold-cards_GM406889139.pdf
- https://ccej.lviv.ua/images/coin-master-hack-spin-generator-tool_GM406889139.pdf
- https://ccej.lviv.ua/images/robux-hack-free-robux_GM431946152.pdf
- https://ccej.lviv.ua/images/coin-master-hack-software_GM406889139.pdf
- https://ccej.lviv.ua/images/roblox-controversy_GM431946152.pdf
- https://ccej.lviv.ua/images/free-rare-cards-for-coin-master-christmas_GM406889139.pdf
- https://ccej.lviv.ua/images/hacks-to-get-free-robux_GM431946152.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000042eb.bin` `e3b66ae89e855283fffecf584245813619392cb90ea99cd3f108bb1605ddbbf7`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x42EB	25040 bytes
`font_01_sfnt_off00007cdb.bin` `0ce5587ab5f08fe28af08a10d13c2b1ec25f0c75a7101ae203f26d727c73e70b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7CDB	19116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.