PDF malware analysis — malicious · ce5a1eb30ae601ef

MALICIOUS

PDF

47.7 KB Created: 2021-05-15 07:02:16 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: f323e08e84405f174f4eb0b0ee00edaf SHA-1: ea187a9d858716ea0e99287657f192bfad1739bc SHA-256: ce5a1eb30ae601ef88fb3d4c2a0dce1586e56567d34c9d44e6c74aef503459d7

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The document contains lures related to advance-fee scams, specifically promising ways to obtain in-game currency or items. It includes an external URI pointing to a URL that appears to be related to game hacks. The presence of multiple URLs suggests an attempt to redirect the user to download further content, likely malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9013

Heuristics 4

Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE

Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.xyz/app/431946152/how-to-get-robux-easy-game-hack
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/toolbox-premium-apk_GM479516143.pdf
- http://www.elearningmtsn9jkt.net/__statics/gudangsoal/files/coin-master-daily-free-spins-blogspot_GM406889139.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/how-to-get-free-robux-on-roblox_GM431946152.pdf
- http://www.elearningmtsn9jkt.net/__statics/gudangsoal/files/roblox-hack-generator_GM431946152.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/free-roblox-clothes_GM431946152.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/minecraft-server-free-trial_GM479516143.pdf
- http://www.elearningmtsn9jkt.net/__statics/gudangsoal/files/coin-master-official-website_GM406889139.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/free-spins-coin-master-legit_GM406889139.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/www-roblox-com-robux-free_GM431946152.pdf
- http://www.elearningmtsn9jkt.net/__statics/gudangsoal/files/coin-master-rewards-free-spins_GM406889139.pdf
- http://www.elearningmtsn9jkt.net/__statics/gudangsoal/files/websites-to-get-free-robux_GM431946152.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/coin-master-32-mod-hack-unlimited_GM406889139.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/coin-master-hack-no-human-verification_GM406889139.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/free-coin-master-spins-blog_GM406889139.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/free-robux-just-click_GM431946152.pdf
- http://www.elearningmtsn9jkt.net/__statics/gudangsoal/files/roblox-microsoft-rewards_GM431946152.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/how-to-hack-coin-master-apple_GM406889139.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/coin-master-free-spins-link-today-haktuts_GM406889139.pdf
- http://www.elearningmtsn9jkt.net/__statics/gudangsoal/files/how-to-change-your-username-in-roblox-for-free_GM431946152.pdf
- https://elearningmtsn9jkt.net/__statics/gudangsoal/files/como-hackear-coin-master-2021-espaol_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_003_off00004b2a.bin` `eb3907c4ae1fd0325106418c4fa3a080ec87b68b739ad9e7d4eb718ede55492a`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x4B2A	26764 bytes
`font_01_sfnt_off00008a4a.bin` `9a13c2580265a78e8a7257496a31ee0055738af7e20a5661c2902efe4bf05ce5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8A4A	5596 bytes
`font_02_sfnt_off000096f2.bin` `b9e2aa841985fb83527df95ccd87a01b1af2ca35417b0d42f05b7d7a63821dbf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x96F2	18528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.