PDF malware analysis — malicious · be418264d3e0f247

MALICIOUS

PDF

44.5 KB Created: 2021-05-16 05:05:01 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: a031b8b353685a7675a3d837c4f6f78e SHA-1: 7a6fd6d5759d4b92e0554fe2a002f9f3f1cfb4d4 SHA-256: be418264d3e0f2473524a8d3a3fca05662240efb15d5ebe9ec57bbb1bc100439

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains multiple links to external websites, many of which are algorithmically generated and hosted on suspicious domains, suggesting a phishing or malware distribution attempt. The presence of a 'download button' heuristic further supports the malicious intent of directing users to download potentially harmful files. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 0.9980

Heuristics 4

PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK

PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/easy-robux-hack-game-hack
- https://grovehilloutfitters.com/images/bux-free-robux_GM431946152.pdf
- https://grovehilloutfitters.com/images/is-minecraft-free-on-xbox-one_GM479516143.pdf
- https://grovehilloutfitters.com/images/synapse-roblox-free_GM431946152.pdf
- https://grovehilloutfitters.com/images/free-spins-coin-master-2021-app_GM406889139.pdf
- https://grovehilloutfitters.com/images/mcpe-com_GM479516143.pdf
- https://grovehilloutfitters.com/images/no-verification-coin-master-hack_GM406889139.pdf
- https://grovehilloutfitters.com/images/coin-master-hack-unlimited-spins_GM406889139.pdf
- https://grovehilloutfitters.com/images/httpswwwurcouponsdealcom202103coinmasterfreespinandcoinlinkshtml_GM406889139.pdf
- https://grovehilloutfitters.com/images/free-daily-coin-master-coins_GM406889139.pdf
- https://grovehilloutfitters.com/images/how-to-hack-people-in-roblox_GM431946152.pdf
- https://grovehilloutfitters.com/images/coins-master_GM406889139.pdf
- https://grovehilloutfitters.com/images/coin-master-pet-food-free_GM406889139.pdf
- https://grovehilloutfitters.com/images/coin-master-hack-ios-download-2021_GM406889139.pdf
- https://grovehilloutfitters.com/images/coin-master-spin-free_GM406889139.pdf
- https://grovehilloutfitters.com/images/hack-spin-coin-master-2021_GM406889139.pdf
- https://grovehilloutfitters.com/images/tryrbx-site-free-robux_GM431946152.pdf
- https://grovehilloutfitters.com/images/play-minecraft-pocket-edition-for-free_GM479516143.pdf
- https://grovehilloutfitters.com/images/roblox-fun-com-free-robux_GM431946152.pdf
- https://grovehilloutfitters.com/images/free-spin-link-for-coin-master_GM406889139.pdf
- https://grovehilloutfitters.com/images/coin-master-heaven-free-spins-link-2021_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000049ee.bin` `913043ce150426cf0ff73e0248619bdd478ced448f594bb5ece0c43fbb75ba2d`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x49EE	27740 bytes
`font_01_sfnt_off00008b15.bin` `2bceebe5c1993dbcd4316f947943b347169ed843d74f7d3766fe916d90107923`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8B15	18428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.