PDF malware analysis — malicious · c3ac1c7a00cbbae0

MALICIOUS

PDF

47.4 KB Created: 2021-05-14 13:01:31 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 4f98a6205720550f0fa89e1bc5145932 SHA-1: 6a1e6b431c09b667f8d58312b406bbe45c14d41a SHA-256: c3ac1c7a00cbbae002071069a23a5c2bca84f873fe9416c0b5de798be47d0b10

102 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains numerous links to external websites, many of which are SEO-optimized pages designed to lure users into downloading game hacks or cheats. The ML classifier strongly flagged this PDF as malicious, and the presence of a "download button" heuristic further supports a malicious intent to trick users into downloading unwanted software. No scripts were extracted, but the extensive link farm suggests a phishing or scamming operation.

Machine Learning

Nyx PDF Classifier malicious score 0.9013

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/406889139/hack-version-of-coin-master-apk-download-game-hack
- http://w-i-r.de/images/how-do-you-get-minecraft-for-free_GM479516143.pdf
- http://w-i-r.de/images/coin-master-hack-with-lucky-patcher_GM406889139.pdf
- http://w-i-r.de/images/how-to-hack-roblox-to-get-robux_GM431946152.pdf
- http://w-i-r.de/images/roblox-hack-site_GM431946152.pdf
- http://w-i-r.de/images/hack-xp-net-generators-coin-master_GM406889139.pdf
- http://w-i-r.de/images/free-robux-no-password_GM431946152.pdf
- http://w-i-r.de/images/free-spins-on-coin-master_GM406889139.pdf
- http://w-i-r.de/images/how-to-get-a-free-minecraft-server_GM479516143.pdf
- http://w-i-r.de/images/free-robux-master_GM431946152.pdf
- http://w-i-r.de/images/free-robux-apk_GM431946152.pdf
- http://w-i-r.de/images/coin-master-free-spins-2021-haktuts_GM406889139.pdf
- http://w-i-r.de/images/robux-free-robux_GM431946152.pdf
- http://w-i-r.de/images/free-robux-codes-2021-not-used_GM431946152.pdf
- http://w-i-r.de/images/como-hackear-coin-master-en-espaol_GM406889139.pdf
- http://w-i-r.de/images/www-roblox-com-robux_GM431946152.pdf
- http://w-i-r.de/images/coin-master-daily-free-spins-link-today_GM406889139.pdf
- http://w-i-r.de/images/free-spins-for-coin-master-hack_GM406889139.pdf
- http://w-i-r.de/images/free-robux-generator-com-roblox-hack_GM431946152.pdf
- http://w-i-r.de/images/coin-master-free-spins-facebook_GM406889139.pdf
- http://w-i-r.de/images/free-spins-coin-master-links_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off000049be.bin` `8ea921d625967c02e8e8a02727e33890ecdf6fc2126bff3e3ea3ec5537242737`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x49BE	25176 bytes
`font_01_sfnt_off00008163.bin` `e06aca5f85e50ae6cefda302c5299c18ab6d27c174f74f0bb0ee8efa7ccb4468`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8163	8676 bytes
`font_02_sfnt_off000095ed.bin` `5b95fa97962658a3e629e8357bf81639977ca58617958822feb21fc523d607ab`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x95ED	18608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.