Malicious PDF — malware analysis report

Static analysis result for SHA-256 c21a52260ee348f6…

MALICIOUS

PDF

42.0 KB Created: 2021-05-16 20:47:30 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7) First seen: 2021-09-27
MD5: f93d779b26f469076335a0bd5d6285f2 SHA-1: 70a41e5ec3a94abef169e265b9ad1dfacd002d36 SHA-256: c21a52260ee348f683758551be0bb39ff7857160e54919b3bd04adfb69495b94
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a lure related to game hacks, specifically for Coin Master, and includes a prominent link to a suspicious URL. The ML classifier strongly flagged this PDF as malicious. While no scripts were explicitly extracted, the presence of embedded URLs and the 'game hack' lure suggest an attempt to redirect the user to a malicious site, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9971

Heuristics 4

  • PDF links to a 'free generator / game hack' redirector high PDF_GAME_HACK_REDIRECT_LURE
    PDF's clickable action targets a redirector of the form /app/<id>/<slug>-game-hack — the landing-page shape of a large SEO 'free spins / generator / game hack' lure family that funnels victims through rotating disposable hosts to a malware/scam payload. The multi-link variants also trip ML/link-farm rules; this catches the single-link variants that otherwise score clean.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://netcdn.xyz/app/406889139/how-to-get-free-unlimited-coins-in-coin-master-game-hack PDF link annotation
    • http://rafaelmontesinos.com/images/minecraft-life-hacks_GM479516143.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/best-site-for-free-coin-master-free-spin-link_GM406889139.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/coin-master-apk-hack_GM406889139.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/roblox-avatar-tester_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/free-spins-from-coin-master_GM406889139.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/roblox-free-robux-no-verification_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/coin-master_GM406889139.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/blox-land-free-robux_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/10-robux_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/earn-robux-now_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/how-to-hack-roblox-accounts-for-robux_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/how-to-get-free-spins-on-coin-master_GM406889139.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/robux-fun-hack_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/minecraft_GM479516143.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/coin-master-email-rewards_GM406889139.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/coin-master-rewards_GM406889139.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/robux-offers_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/daily-coin-master-link_GM406889139.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/how-to-actually-get-free-robux_GM431946152.pdfIn PDF document text
    • http://rafaelmontesinos.com/images/how-to-change-your-roblox-username-for-free-2021_GM431946152.pdfIn PDF document text
    • http://en.wikipedia.org/wiki/MIT_LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off00004a0f.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x4A0F 24856 bytes
SHA-256: 2c3984188229353981a8a185852610d649aede19ec898dc3a6eaaad9a49e2b08
font_01_sfnt_off00008119.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8119 18568 bytes
SHA-256: 17c3bfe6e2b09087d9b288dc5214e8ea6d8a39f73936503e3f6998c4d0212d6e

Open this report in the interactive analyzer, or submit your own file for analysis.