PDF malware analysis — malicious · cfffa0dd026ca388

MALICIOUS

PDF

44.9 KB Created: 2021-06-03 20:51:14 +07:00 Authoring application: wkhtmltopdf 0.12.6 (via Qt 4.8.7)

MD5: 807e1bd0b4e36d8ebb1de2f111cbb10e SHA-1: 09d06bd1c608a93be296bd801b2e5a630e3637b3 SHA-256: cfffa0dd026ca38854ef89309b4ffeff168afd622cd2b53b96a42265377982aa

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains multiple embedded URLs and a visual download button lure, directing users to sites offering game hacks and cheats. The ML classifier strongly flagged this PDF as malicious, indicating it likely serves as a lure for downloading malicious payloads disguised as game modifications. No scripts were extracted, but the presence of external URIs and the ML detection suggest a high likelihood of malware distribution.

Machine Learning

Nyx PDF Classifier malicious score 0.9865

Heuristics 4

QR-code redirect lure medium SE_QR_LURE

Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://netcdn.online/app/479516143/best-minecraft-hacked-client-game-hack
- https://kojak-group.com/userfiles/files/minecraft-bedrock-download-pc-free_GM479516143.pdf
- https://kojak-group.com/userfiles/files/how-to-get-robux-for-free-2021_GM431946152.pdf
- https://kojak-group.com/userfiles/files/minecraft-free-computer-game_GM479516143.pdf
- https://kojak-group.com/userfiles/files/roblox-free-robux-hack_GM431946152.pdf
- https://kojak-group.com/userfiles/files/can-you-get-free-robux-on-roblox_GM431946152.pdf
- https://kojak-group.com/userfiles/files/is-it-possible-to-get-free-robux_GM431946152.pdf
- https://kojak-group.com/userfiles/files/coin-master-hacks-iphone_GM406889139.pdf
- https://kojak-group.com/userfiles/files/daily-free-spins-for-coin-master_GM406889139.pdf
- https://kojak-group.com/userfiles/files/free-spins-coin-master-legit_GM406889139.pdf
- https://kojak-group.com/userfiles/files/coin-master-free-coins-and-spins-hack_GM406889139.pdf
- https://kojak-group.com/userfiles/files/how-to-change-your-username-on-roblox-for-free_GM431946152.pdf
- https://kojak-group.com/userfiles/files/coin-master-200-spin-link_GM406889139.pdf
- https://kojak-group.com/userfiles/files/coin-master-free-spins-link-2021-haktuts_GM406889139.pdf
- https://kojak-group.com/userfiles/files/free-robux-come_GM431946152.pdf
- https://kojak-group.com/userfiles/files/free-robux-link_GM431946152.pdf
- https://kojak-group.com/userfiles/files/coin-master-daily-free-spins-link-2021-today_GM406889139.pdf
- https://kojak-group.com/userfiles/files/bad-minecraft-free_GM479516143.pdf
- https://kojak-group.com/userfiles/files/minecraft-windows-10-edition-free_GM479516143.pdf
- https://kojak-group.com/userfiles/files/coin-master-hack-unlimited-spins-apk-download_GM406889139.pdf
- https://kojak-group.com/userfiles/files/daily-free-spins-coin-master-2021_GM406889139.pdf
- http://en.wikipedia.org/wiki/MIT_License

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off000052ff.bin` `78c31113a4909c521aea3fad2934ac7dd695967f4b74876aab6927023ca79040`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x52FF	25728 bytes
`font_01_sfnt_off00008d60.bin` `05f9c4237b996275e109c4becad50b5cb7d88affc4d3e55964976ee2f9eee8f2`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8D60	18200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.